Abstract:The emergence of new network applications, such as the network intrusion detection system and packet-level accounting, requires packet classification to report all matched rules instead of only the best matched rule. Although several schemes have been proposed recently to address the multimatch packet classification problem, most of them require either huge memory or expensive ternary content addressable memory (TCAM) to store the intermediate data structure, or they suffer from steep performance degradation under certain types of classifiers. In this paper, we decompose the operation of multimatch packet classification from the complicated multidimensional search to several single-dimensional searches, and present an asynchronous pipeline architecture based on a signature tree structure to combine the intermediate results returned from single-dimensional searches. By spreading edges of the signature tree across multiple hash tables at different stages, the pipeline can achieve a high throughput via the interstage parallel access to hash tables. To exploit further intrastage parallelism, two edge-grouping algorithms are designed to evenly divide the edges associated with each stage into multiple work-conserving hash tables. To avoid collisions involved in hash table lookup, a hybrid perfect hash table construction scheme is proposed. Extensive simulation using realistic classifiers and traffic traces shows that the proposed pipeline architecture outperforms HyperCuts and B2PC schemes in classification speed by at least one order of magnitude, while having a similar storage requirement. Particularly, with different types of classifiers of 4K rules, the proposed pipeline architecture is able to achieve a throughput between 26.8 and 93.1 Gb/s using perfect hash tables.

Dynamic Allocation and Hash Table Based Match Algorithms for Firewall Rules

A fast hash packet classification algorithm

Network model and heuristic scheduling rule designing method for complex open shop problems

Control Framework for Large Networks

Optimization to Firewall Rule-Matching with Statistic Analysis

Policy Based Access Control Framework for Large Networks

Using Dual Chain Hash Table to Improve Performance of NP Firewall

Dynamic Security Rule Optimization Based on Deep Learning and Adaptive Algorithms

Balancer: A Traffic-Aware Hybrid Rule Allocation Scheme in Software Defined Networks.

High-Throughput and Memory-Efficient Multimatch Packet Classification Based on Distributed and Pipelined Hash Tables.

Algorithm for Fast Detecting Firewall Rule Configuration Mistakes

A Dynamic Flow Table Management Method Based on Real-time Traffic Monitoring

An Algorithm for Detecting Firewall Filters Conflicts

High-performance multi-pattern matching structure in hardware network firewall

Rules in Play: On the Complexity of Routing Tables and Firewalls

Dynamic Update of Firewall Policy Based on MFDT

Dynamic intelligent resource allocation for emergency situations

A Distributed Cooperative Mechanism Of Software Based Network Security Filtering

Dynamic Routing For Network Throughput Maximization In Software-Defined Networks

Load Balancing Algorithm for High-Speed Network Intrusion Detection Systems

The Joint Optimization of Rules Allocation and Traffic Engineering in Software Defined Network.