Abstract:String matching is a key technique for network security applications such as network intrusion detection systems and antivirus scanners, where the payload of every packet is inspected against thousands of patterns in real time. As the transmission rate of Internet links is getting higher and higher, the speed of matching engines is required to be faster and faster. Existing deterministic finite automaton (DFA)-based approaches achieve high throughput at the expense of extremely expensive memory cost; therefore, they are not suitable for the scenarios where only limited on-chip memory resources are available. To achieve fast matching speed while controlling memory expense, in this paper, we propose Kangaroo, a compact string matching scheme that scans multiple characters each time by running multiple small-sized finite state machines in parallel. Specifically, Kangaroo processes k consecutive characters mostly in one cycle by accessing k different memories in parallel, where k is a predefined factor that can be tuned based on the requirement of applications. Kangaroo is memory efficient. Experimental evaluations on Snort and ClamAV rule sets show that a tenfold increase in speed can be practically achieved by a single Kangaroo matching engine with a reduced memory cost comparing with the state-of-the-art DFA-based approaches.

A Multi-Pattern Matching Algorithm for the Large-scale URL Keywords

Multi-Gigabit Rate Pattern-Matching Engine Using Grouping CAM/TCAM

TFD: A Multi-Pattern Matching Algorithm for Large-Scale URL Filtering

Memory Efficient Algorithm and Architecture for Multi-Pattern Matching

A fast string matching algorithm for large-scale pattern sets

Comparison Of Stringmatching Algorithms: An Aid To Information Content Security

An Improved Multi-pattern Matching Algorithm for Large-Scale Pattern Sets

Kangaroo: Accelerating String Matching by Running Multiple Collaborative Finite State Machines

A Fast Engine for Multi-String Pattern Matching.

A Path Combinational Method for Multiple Pattern Matching

A Multiple-Pattern Matching Algorithm Based on Bitmap

A Memory-Efficient Multi-pattern Matching Algorithm Based on the Bitmap

Another CDFA Based Multi-Pattern Matching Algorithm and Architecture for Packet Inspection.

Towards High-Performance Pattern Matching on Multi-Core Network Processing Platforms

Memory Efficient String Matching Algorithm for Network Intrusion Management System

An Efficient Adaptive Architecture for Multi-pattern Matching

A High Speed Matching Algorithm of Unfixed-position Key Words Based on Bloom Filter

Research of Single Pattern Matching Algorithm Based on Suffix Searching

A Word-length Based Wu-manber Multi-pattern Matching Algorithm

ON WU_MAMBER MULTIPLE PATTERN MATCHING ALGORITHM IN INTRUSION DETECTION SYSTEM

An algorithm of large-scale approximate multiple string matching for network security