Abstract:With rapid advancement in Internet technology and usages, some emerging applications in data communications and network security require matching of huge volume of data against large signature sets with thousands of strings in real time. In this article, we present a memory-efficient hardware implementation of the well-known Aho-Corasick (AC) string-matching algorithm using a pipelining approach called P-AC. An attractive feature of the AC algorithm is that it can solve the string-matching problem in time linearly proportional to the length of the input stream, and the computation time is independent of the number of strings in the signature set. A major disadvantage of the AC algorithm is the high memory cost required to store the transition rules of the underlying deterministic finite automaton. By incorporating pipelined processing, the state graph is reduced to a character trie that only contains forward edges. Together with an intelligent implementation of look-up tables, the memory cost of P-AC is only about 18 bits per character for a signature set containing 6,166 strings extracted from Snort. The control structure of P-AC is simple and elegant. The cost of the control logic is very low. With the availability of dual-port memories in FPGA devices, we can double the system throughput by duplicating the control logic such that the system can process two data streams concurrently. Since our method is memory-based, incremental changes to the signature set can be accommodated by updating the look-up tables without reconfiguring the FPGA circuitry.

Making Multi-String Pattern Matching Scalable and Cost-Efficient with Programmable Switching ASICs

Bolt: Scalable and Cost-Efficient Multistring Pattern Matching with Programmable Switches

Multi-Gigabit Rate Pattern-Matching Engine Using Grouping CAM/TCAM

P4rex: Accelerating Regular Expression Matching with Programmable Switches

Melody: Toward Resource-Efficient Packet Header Vector Encoding on Programmable Switches.

Toward Scalable and Low-Cost Traffic Testing for Evaluating DDoS Defense Solutions

Resource-Efficient and Timely Packet Header Vector (PHV) Encoding on Programmable Switches

Excalibur: A Scalable and Low-Cost Traffic Testing Framework for Evaluating DDoS Defense Solutions.

P4CTM: Compressed Traffic Pattern Matching Based on Programmable Data Plane

Scalable string matching framework enhanced by pattern clustering

A High Performance and Scalable Packet Pattern-Matching Architecture

Pipelined Parallel AC-Based Approach for Multi-String Matching

Ultra-High Throughput String Matching for Deep Packet Inspection

Pipelined Architecture for Multi-String Matching.

SCADIS: A Scalable Accelerator for Data-Intensive String Set Matching on FPGAs

Multilevel Pattern Matching Architecture for Network Intrusion Detection and Prevention System

A fast string matching algorithm for large-scale pattern sets

High-performance multi-pattern matching structure in hardware network firewall

A memory-efficient pipelined implementation of the aho-corasick string-matching algorithm

Towards High-Performance Pattern Matching on Multi-Core Network Processing Platforms

Fast Dynamic Pattern Matching for Deep Packet Inspection