Optimized memory based accelerator for scalable pattern matching

Microprocessors and Microsystems

Volumn 33, Issue 7-8, 2009, Pages 469-482

  Vespa, Lucas ^a   Weng, Ning ^a   Soewito, Benfano ^a  

^a Southern Illinois University Carbondale   (United States)

Author keywords

Memory decoder design; Network intrusion detection; Pattern matching

Indexed keywords

ATTACK PATTERNS; BASIC IDEA; DETERMINISTIC FINITE AUTOMATA; INCOMING PACKETS; LINE RATE; MEMORY DECODER DESIGN; MEMORY SLOTS; NETWORK ATTACK; NETWORK INTRUSION DETECTION; NETWORK INTRUSION DETECTION SYSTEMS; NETWORK TRAFFIC; PROGRAMMABILITY; RESOURCE REQUIREMENTS; STORAGE REQUIREMENTS;

COMPUTER CRIME; DECODING; FINITE AUTOMATA; INTERNET; PATTERN MATCHING; ROBOTS; TRANSLATION (LANGUAGES);

INTRUSION DETECTION;

EID: 70350511917     PISSN: 01419331     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.micpro.2009.09.003     Document Type: Article

References (37)

1. Z. Baker, V.K. Prasanna, A methodology for synthesis of efficient intrusion detection systems on FPGAs, in: Proceedings of the IEEE Conference on Field-Programmable Custom Computing Machines, Napa, CA, April 2004, pp. 135-144.
2. M. Becchi, S. Cadambi, Memory-efficient regular expression search using state merging, in: Proceedings of the IEEE Infocom, Anchorage, AK, May 2007, pp. 1064-1072.
3. M. Becchi, P. Crowley, An improved algorithm to accelerate regular expression evaluation, in: Proceedings of the ACM/IEEE Symposium on Architectures for Networking and Communications Systems, Orlando, FL, 2007, pp. 145-154.
4. Brodie B.C., Taylor D.E., and Cytron R.K. A scalable architecture for high-throughput regular-expression pattern matching. SIGARCH Comput. Archit. News 34 2 (2006) 191-202
5. L. Bu, J.A. Chandy, FPGA based network intrusion detection using content addressable memories, in: FCCM '04: Proceedings of the 12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines, Washington, DC, USA, 2004, pp. 316-317.
6. Y.H. Cho, W.H. Mangione-Smith, Deep packet filter with dedicated logic and read only memories, in: FCCM'04: Proceedings of the 12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines, Washington, DC, USA, 2004, pp. 125-134.
7. Denning D. An intrusion-detection model. IEEE Transactions on Software Engineering 13 2 (1987) 222-232
8. Dharmapurikar S., Krishnamurthy P., Sproull T.S., and Lockwood J.W. Deep packet inspection using parallel bloom filters. IEEE Micro 24 1 (2004) 52-61
9. M. Fisk, G. Varghese, Applying fast string matching to intrusion detection, Los Alamos National Lab Report, 2002.
10. S. Kumar, S. Dharmapurikar, F. Yu, P. Crowley, J. Turner, Algorithms to accelerate multiple regular expressions matching for deep packet inspection, in: Proceedings of the ACM SIGCOMM, 2006, pp. 339-350.
11. A. Mahajan, B. Soewito, S. Parsi, N. Weng, H. Wang, Implementing high-speed string matching hardware for network intrusion detection systems, in: Proceedings of the Sixteenth ACM/SIGDA International Symposium on Field-Programmable Gate Arrays (FPGA), Monterey, CA, 2008, pp. 264-264.
12. J. Moscola, J. Lockwood, R.P. Loui, M. Pachos, Implementation of a content-scanning module for an internet firewall, in: FCCM'03: Proceedings of the 11th Annual IEEE Symposium on Field-Programmable Custom Computing Machines, Washington, DC, USA, 2003, pp. 31-38.
13. M. Roesch, Snort - lightweight intrusion detection for networks, in: Proceedings of the 13th USENIX Conference on System Administration, Seattle, Washington, 1999, pp. 229-238.
14. R. Sidhu, V.K. Prasanna, Fast regular expression matching using fpgas, in: FCCM'01: Proceedings of the 9th Annual IEEE Symposium on Field-Programmable Custom Computing Machines, Washington, DC, USA, 2001, pp. 227-238.
15. Snort Rule Database, 2007. .
16. B. Soewito, N. Weng, Approximate packet pre-filtering to accelerate pattern matching, in: Proceedings of the 2008 International Conference on Security and Management (SAM), Las Vegas, Nevada, July 2008, pp. 203-209.
17. Sourdis I., and Pnevmatikatos D. Fast, large-scale string match for a 10gbps fpga-based network intrusion. In: Lysaght P., and Rosenstiel W. (Eds). New Algorithms, Architectures, and Applications for Reconfigurable Computing (2005), Springer 195-207 (Chapter 16)
18. L. Tan, T. Sherwood, A high throughput string matching architecture for intrusion detection and prevention, in: ISCA'05: Proceedings of the 32nd Annual International Symposium on Computer Architecture, Washington, DC, USA, 2005, pp. 112-122.
19. J. van Lunteren, High-performance pattern-matching for intrusion detection, in: Proceedings of the 25th IEEE International Conference on Computer Communications, 2006, pp. 1-13.
20. Varghese G. Network Algorithmics: An Interdisciplinary Approach to Designing Fast Networked Devices. first ed. (2005), Morgan Kaufman
21. F. Yu, Z. Chen, Y. Diao, T. Lakshman, R.H. Katz, Fast and memory-efficient regular expression matching for deep packet inspection, in: Proceedings of the ACM/IEEE Symposium on Architecture for Networking and Communications Systems, 2006, pp. 93-102.
22. F. Yu, R.H. Katz, T.V. Lakshman, Gigabit rate packet pattern-matching using TCAM, in: Proceedings of the 12th IEEE International Conference the Network Protocols, Washington, DC, USA, 2004, pp. 174-183.
23. Aho A., and Corasick M. Efficient string matching: an aid to bibliographic search. Communications of the ACM 18 6 (1975) 333-340
24. Boyer R.S., and Moore J.S. A fast string searching algorithm. Communication of the ACM 20 10 (1977) 762-772
25. B. Commentz-Walter, A string matching algorithm fast on the average, in: Proceedings of the 6th International Colloquium on Automata, Languages and Programming, 1979, pp. 118-132.
26. S. Wu, Manber, A fast algorithm for multi-pattern searching, Technical Report TR94-17, Department of Computer Science, University of Arizona, 1994.
27. Aldwairiand M., Conte T., and Franzon P. Configurable string matching hardware for speeding up intrusion detection. SIGARCH Comput. Archit. News 33 1 (2005) 99-107
28. Singaraju J., and Chandy J.A. FPGA based string matching for network processing applications. Microprocessors and Microsystems 32 4 (2007) 210-222
29. C.R. Clark, D.E. Schimmel, Scalable pattern matching for high speed networks, in: 12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines, April 2004, pp. 249-257.
30. Waldvogel M., Varghese G., Turner J., Plattner B., and Zrich E. Scalable high-speed prefix matching. ACM Transactions on Computer Systems 19 4 (2001) 440-482
31. F. Baboescu, S. Singh, G. Varghese, Packet classification for core routers: is there an alternative to CAMs? in: IEEE Infocom, 2003, pp. 1-11.
32. P. Gupta, N. McKeown, Packet classification on multiple fields, in: SIGCOMM'99: Proceedings of the Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, 1999, pp. 147-160.
33. S. Singh, F. Baboescu, G. Varghese, J. Wang, Packet classification using multidimensional cutting, in: SIGCOMM'03: Proceedings of the 2003 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, 2003, pp. 213-224.
34. George Varghese, Public Review for Algorithms to Accelerate Multiple Regular Expression Matching for Deep Packet Inspection, http://conferences.sigcomm.org/sigcomm/2006/discussion/getfile.php?paper_id=32&name=PublicReview (by George Varghese).
35. E.L. Horta, J.W. Lockwood, D.E. Taylor, D. Parlour, Dynamic hardware plugins in an FPGA with partial run-time reconfiguration, in: Proceedings of 39th Design Automation Conference, 2002, pp. 343-348.
36. R. Smith, C. Estan, S. Jha, XFA: faster signature matching with extended automata, in: SP'08: Proceedings of the 2008 IEEE Symposium on Security and Privacy, 2008, pp. 187-201.
37. Liu R.-T., Huang N.-F., Chen C.-H., and Kao C.-N. A fast string-matching algorithm for network processor-based intrusion detection system. ACM Transactions on Embedded Computing Systems (TECS) 3 3 (2004) 614-633