Scalable multi-pipeline architecture for high performance multi-pattern string matching

Proceedings of the 2010 IEEE International Symposium on Parallel and Distributed Processing, IPDPS 2010

Volumn , Issue , 2010, Pages

  Jiang, Weirong ^a   Yang, Yi Hua E ^a   Prasanna, Viktor K ^a  

^a University of Southern California ^*  (United States)

Author keywords

Deep packet inspection; DFA; FPGA; Pipeline; String matching

Indexed keywords

AHO-CORASICK; ANTI-VIRUS SYSTEMS; CLOCK CYCLES; DEEP PACKET INSPECTION; DETERMINISTIC FINITE AUTOMATA; FPGA DEVICES; FPGA IMPLEMENTATIONS; HARDWARE IMPLEMENTATIONS; HIGH THROUGHPUT; HIGH-SPEED; IN-NETWORK; LINEAR PIPELINE; LOGIC RESOURCES; MEMORY REQUIREMENTS; MULTIPLE PIPELINES; NUMBER OF STATE; ON CHIPS; PATTERN SET; PATTERN STRINGS; PERFORMANCE BOTTLENECKS; PIPELINE ARCHITECTURE; PIPELINED PROCESSING; RESOURCE REQUIREMENTS; RULE SET; STRING MATCHING; THROUGHPUT IMPROVEMENT;

COMPUTER VIRUSES; DISTRIBUTED PARAMETER NETWORKS; FINITE AUTOMATA; HARDWARE; INSPECTION; INTRUSION DETECTION; PACKET NETWORKS; PIPELINES; THROUGHPUT; VIRUSES;

PIPELINE PROCESSING SYSTEMS;

EID: 77953999220     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/IPDPS.2010.5470374     Document Type: Conference Paper

References (21)

1. Snort: Open source network IDS/IPS, "http://www.snort.org."
2. Clam AntiVirus, "http://www.clamav.net."
3. D. Pao, W. Lin, and B. Liu, "Pipelined architecture for multi-string matching," Computer Architecture Letters, vol.7, no.2, pp. 33-36, Feb. 2008.
4. Y.-H. E. Yang and V. K. Prasanna, "Memory-efficient pipelined architecture for large-scale string matching," in FCCM 2009. 17th Annual IEEE Symposium on Field-Programmable Custom Computing Machines, April 2009.
5. M. Alicherry, M. Muthuprasanna, and V. Kumar, "High speed pattern matching for network IDS/IPS," in ICNP '06: Proceedings of the 2006 IEEE International Conference on Network Protocols. IEEE Computer Society, 2006, pp. 187-196.
6. P.-C. Lin, Y.-D. Lin, T.-H. Lee, and Y.-C. Lai, "Using string matching for deep packet inspection," Computer, vol.41, no.4, pp. 23-28, April 2008.
7. M. Crochemore and T. Lecroq, "Sequential multiple string matching," in Encyclopedia ofAlgorithms,M.Y.Kao,Ed. Berlin: Springer, 2008, pp. 826-829.
8. T. Song, W. Zhang, D. Wang, and Y. Xue, "A memory efficient multiple pattern atching architecture for network security," in INFOCOM 2008. The 27th Conference on Computer Communications. IEEE, April 2008, pp. 166-170.
9. D. P. Scarpazza, O. Villa, and F. Petrini, "High-speed string searching against large dictionaries on the cell/b.e. processor," in Parallel and Distributed Processing, 2008. IPDPS 2008. IEEE International Symposium on, April 2008, pp. 1-12.
10. S. Antonatos, K. G. Anagnostakis, and E. P. Markatos, "Generating realistic workloads for network intrusion detection systems," SIGSOFT Softw. Eng. Notes, vol.29, no.1, pp. 207-215, 2004.
11. O. Villa, D. Chavarria, and K. Maschhoff, "Input-independent, scalable and fast string matching on the Cray XMT," in Parallel and Distributed Processing, 2009. IPDPS 2009. IEEE International Symposium on, April 2009, pp. 1-12.
12. N. Hua, H. Song, and T. V. Lakshman, "Variable-stride multi- pattern matching for scalable deep packet inspection," in INFOCOM 2009. The 28th Conference on Computer Communications. IEEE, April 2009.
13. N. Tuck, T. Sherwood, B. Calder, and G. Varghese, "Deterministic memory-efficient string matching algorithms for intrusion detection," in INFOCOM 2004. Twenty-third Annu- alJoint Conference of the IEEE Computer and Communications Societies, vol.4, March 2004, pp. 2628-2639 vol.4.
14. J. van Lunteren, "High-performance pattern-matching for intrusion detection," in INFOCOM 2006. 25th IEEE International Conference on Computer Communications. Proceedings, April 2006, pp. 1-13.
15. Z. Baker and V. Prasanna, "A computationally efficient engine for flexible intrusion detection," Very Large Scale Integration (VLSI) Systems, IEEE Transactions on, vol.13, no.10, pp. 1179-1189, Oct. 2005.
16. W. Jiang and V. K. Prasanna, "Field-split parallel architecture for high performance multi-match packet classification using FPGAs," in SPAA '09: Proceedings of the twenty-first annual symposium on Parallelism in algorithms and architectures. ACM, 2009, pp. 188-196.
17. Y.-H. E. Yang, W. Jiang, and V. K. Prasanna, "Compact architecture for high-throughput regular expression matching on FPGA," in ANCS '08: Proceedings of the 4th ACM/IEEE Symposium on Architectures for Networking and Communications Systems. ACM, 2008, pp. 30-39.
18. T. AbuHmed, A. Mohaisen, and D. Nyang, "A survey on deep packet inspection for intrusion detection systems," CoRR, vol. abs/0803.0037, 2008. [Online]. Available: http://arxiv.org/abs/0803.0037
19. G. Vasiliadis, S. Antonatos, M. Polychronakis, E. P. Markatos, and S. Ioannidis, "Gnort: High performance network intrusion detection using graphics processors," in RAID '08: Proceedings of the 11th international symposium on Recent Advances in Intrusion Detection. Springer-Verlag, 2008, pp. 116-134.
20. L. Tan and T. Sherwood, "A high throughput string matching architecture for intrusion detection and prevention," in ISCA '05: Proceedings of the 32nd annual international symposium on Computer Architecture. IEEE Computer Society, 2005, pp. 112-122.
21. I. Sourdis, D. N. Pnevmatikatos, and S. Vassiliadis, "Scalable multigigabit pattern matching for packet inspection," IEEE Trans. VLSI Syst., vol.16, no.2, pp. 156-166, 2008.