Abstract:With rapid advancement in Internet technology and usages, some emerging applications in data communications and network security require matching of huge volume of data against large signature sets with thousands of strings in real time. In this article, we present a memory-efficient hardware implementation of the well-known Aho-Corasick (AC) string-matching algorithm using a pipelining approach called P-AC. An attractive feature of the AC algorithm is that it can solve the string-matching problem in time linearly proportional to the length of the input stream, and the computation time is independent of the number of strings in the signature set. A major disadvantage of the AC algorithm is the high memory cost required to store the transition rules of the underlying deterministic finite automaton. By incorporating pipelined processing, the state graph is reduced to a character trie that only contains forward edges. Together with an intelligent implementation of look-up tables, the memory cost of P-AC is only about 18 bits per character for a signature set containing 6,166 strings extracted from Snort. The control structure of P-AC is simple and elegant. The cost of the control logic is very low. With the availability of dual-port memories in FPGA devices, we can double the system throughput by duplicating the control logic such that the system can process two data streams concurrently. Since our method is memory-based, incremental changes to the signature set can be accommodated by updating the look-up tables without reconfiguring the FPGA circuitry.

Fast String Matching with Overlapped Substring Classifier in Deep Packet Inspection Systems

Ultra-High Throughput String Matching for Deep Packet Inspection

Research and Design of a Novel Deep Packet Inspection Engine

A Memory-Efficient Parallel String Matching Architecture for High-Speed Intrusion Detection

Parallel Architecture for High Throughput DFA-Based Deep Packet Inspection

StriD²FA: Scalable Regular Expression Matching for Deep Packet Inspection

Strid(2)Fa: Scalable Regular Expression Matching For Deep Packet Inspection

DTRadar: Accelerating Search Process of Decision Trees in Packet Classification.

BSPM: A New Mechanism for “Overlap-Matching Expressions” in DPI

SPC-FA: synergic parallel compact finite automaton to accelerate multi-string matching with low memory.

A Fast Multi-pattern Matching Algorithm for Deep Packet Inspection on a Network Processor

A 60gbps DPI Prototype Based on Memory-Centric FPGA

Accelerating Deep Packet Inspection With SIMD-Based Multi-Literal Matching Engine

Kangaroo: Accelerating String Matching by Running Multiple Collaborative Finite State Machines

FROD: an Efficient Framework for Optimizing Decision Trees in Packet Classification

Parallel Dfa Architecture For Ultra High Throughput Dfa-Based Pattern Matching

Cache-Based Scalable Deep Packet Inspection with Predictive Automaton.

StriFA: Stride Finite Automata for High-Speed Regular Expression Matching in Network Intrusion Detection Systems

Step-FA: Step-Based Compact Finite Automaton for Accelerating Multi-String Matching

Scalable string matching framework enhanced by pattern clustering

A memory-efficient pipelined implementation of the aho-corasick string-matching algorithm