FRAPPE: Feasibility Report on Accelerating Payload Pattern-matching Engines in Intrusion Detection Systems with FPGAs

Modern Intrusion Detection Systems (IDS) struggle to scale to 100+ Gbps throughput, as typically, the Multi-Pattern Matching (MPM) stage overwhelms CPU resources. While FPGA-based acceleration offers a theoretical solution, its adoption in production environments remains negligible despite decades of research. This disconnect stems not from a lack of raw hardware performance, but from unmatched IDS requirements and seemingly invasive integration. In this paper, we propose a standardized, stateless offload architecture based on the DPDK rte_flow API that decouples hardware acceleration from complex IDS logic. By using the FPGA as a smart tagger that annotates packets with matched pattern IDs via a compact metadata interface, we enable inline, scalable, integration with existing IDS pipelines like Suricata. We validate this approach through a trace-driven co-design study, demonstrating that a small metadata budget of three pattern IDs per packet is sufficient to offload the vast majority of traffic, resulting in up to 57% throughput increase. Finally, we survey state-of-the-art 100+ Gbps FPGA engines against our derived integration criteria to highlight the critical features that future designs must implement to enable practical deployment.