Multi-Stride string searching for high-speed content inspection

Computer Journal

Volumn 55, Issue 10, 2012, Pages 1216-1231

  Pao, Derek ^a   Wang, Xing ^a  

^a CITY UNIVERSITY OF HONG KONG   (Hong Kong)

Author keywords

application specific hardware system; content inspection; dynamic perfect hash table; string matching

Indexed keywords

APPLICATION SPECIFIC HARDWARES; ARCHITECTURAL FEATURES; HARDWARE CIRCUITS; HARDWARE-ASSISTED; HASH TABLE; HIGH-SPEED; INPUT DATAS; MEMORY COST; NEW DESIGN; PATTERN SET; PROCESSING RATES; RESEARCH TOPICS; SAMPLING UNITS; STRING MATCHING; STRING-SEARCHING; VIRUS SCANNING;

COSTS; HARDWARE; INSPECTION; MEMORY ARCHITECTURE; VIRUSES;

DESIGN;

EID: 84867325287     PISSN: 00104620     EISSN: 14602067     Source Type: Journal    
DOI: 10.1093/comjnl/bxs093     Document Type: Article

References (31)

1. ClamAV anti-virus system, http://www.clamav.net.
2. Snort intrusion detection system, http://www.snort.org.
3. IETF RFC 1321 (1992) The MD5 Message-Digest Algorithm. The Internet Engineering Task Force, Fremont, California, USA.
4. Yu, F., Katz, R.H. and Lakshman, T.V. (2004) Gigabit Rate Packet Pattern-Matching Using TCAM. Proc. Int. Conf. Network Protocols, Berlin, Germany, October 5-8, pp.174-183. IEEE CS Press, Los Alamitos, CA.
5. Song, H., Sproull, T., Attig, M. and Lockwood, J. (2005) Snort Offloader: A Reconfigurable Hardware NIDS Filter. Proc. Int. Conf. on Field Programmable Logic and Applications, Tampere, Finland, August 24-26, pp. 493-498. IEEE CS Press, Los Alamitos, CA.
6. Cho,Y.H. and Mangione-Smith,W.H. (2005) Fast Reconfiguring Deep Packet Filter for 1+ Gigabit Network. Proc. Int. Symp. on Field-Programmable Custom Computing Machines, Napa, CA, April 18-20, pp. 215-224. IEEE CS Press, Los Alamitos, CA.
7. Papadopoulos, G. and Pnevmatikatos, D. (2005) Hashing + Memory = Low Cost, Exact Pattern Matching. Proc. Int. Conf. on Field Programmable Logic and Applications, Tampere, Finland, August 24-26, pp. 39-44. IEEE CS Press, Los Alamitos, CA.
8. Dharmapurikar, S. and Lockwood, J. (2006) Fast and scalable pattern matching for network intrusion detection systems. IEEE J. Sel. Areas Commun., 24, 1781-1792.
9. Brown, J.D., Woodward, S., Bass, B.M., Johnson, C.L. (2011) IBM power edge of network processor: A wire-speed system on a chip. IEEE Micro, 31, 76-85.
10. Clark, C.R. and Schimmel, D.E. (2005) Efficient Reconfigurable Logic Circuits for Matching Complex Network Intrusion Detection Patterns. Field-Programmable Logic and Applications, Lecture Notes in Computer Science 2778, Lisbon, Portugal, September 1-3, pp. 956-959.
11. Baker, Z.K. and Prasanna, V.K. (2006) Automatic synthesis of efficient intrusion detection systems on FPGAs. IEEE Trans. Dependable Secure Comput., 3, 289-300.
12. Sourdis, I., Pnevmatikatos,V. andVassiliadis, S. (2008) Scalable multigigabit pattern matching for packet inspection. IEEE Trans. VLSI Syst., 16, 156-166.
13. Ho, J. and Lemieux, G. F. (2008) PERG:AScalable FPGA-Based Pattern-Matching Engine with CONSOLIDATED BLOOMIER FIlters. Proc. Int. Conf. on Field-Programmable Technology, Taipei, Taiwan, December 7-11, pp. 73-80. IEEE CS Press, Los Alamitos, CA.
14. Pao, D., Wang, X., Wang, X., Cao, C. and Zhu,Y. (2011) String searching engine for virus scanning. IEEE Trans. Comput., 60, 1596-1609.
15. Aho, A. and Corasick, M. (1975) Efficient string matching: An aid to bibliographic search. Commun. ACM, 18, 333-340.
16. Tan, L., Brotherton, B. and Sherwood, T. (2006) Bit-split stringmatching engines for intrusion detection and prevention. ACM Trans. Archit. Code Optim., 3, 3-34.
17. Van Lunteren, J. (2006) High-Performance Pattern-Matching for Intrusion Detection. Proc. 25th Int. Conf. Computer Communications, Barcelona, Spain, April 23-29, pp. 1-13. IEEE CS Press, Los Alamitos, CA.
18. Dimopoulos, V., Papaefstathiou, I. and Pnevmatikatos, D. (2007) A Memory-Efficient Reconfigurable Aho-Corasick FSM Implementation for Intrusion Detection Systems. Proc. Int. Conf. on Embedded Computer Systems: Architectures, Modeling and Simulations, Samos, Greece, July 16-19, pp. 186-193. IEEE CS Press, Los Alamitos, CA.
19. Song, T., Zhang, W., Wang, D. and Xue, Y. (2008) A Memory Efficient Multiple Pattern Matching Architecture for Network Security. Proc.INFOCOM, Phoenix, USA,April 13-18, pp. 673-681. IEEE CS Press, Los Alamitos, CA.
20. Pao, D., Lin,W. and Liu, B. (2010)A memory efficient pipelined implementation of the Aho-Corasick string matching algorithm. ACM Trans. Archit. Code Optim., 7, Article 10.
21. Brodie, B.C., Cytron, R.K. and Taylor, D.E. (2006) A Scalable Architecture for High-Throughput Regular-Expression Pattern Matching. Proc. Int. Symp. on Computer Architecture, Boston, MA, USA, June 17-21, pp. 191-202. IEEE CS Press, Los Alamitos, CA.
22. Alicherry, M., Muthuprasanna M. and Kumar, V. (2006) High Speed Matching for Network IDS/IPS. Proc. Int. Conf. on Network Protocols, Santa Barbara, CA, USA, November 12-15, pp. 187-196. IEEE CS Press, Los Alamitos, CA.
23. Bremler-Barr, A., Hay, D. and Koral, Y. (2010) Compact DFA: Generic State Machine Compression for Scalable Pattern Matching. Proc. INFOCOM, San Diego, USA, March 15-19, pp. 1-9. IEEE CS Press, Los Alamitos, CA.
24. Pao, D., Li, Y.K. and Zhou, P. (2006) Efficient packet classification using TCAMs. Comput. Netw., 50, 3523-3535.
25. Hua, N., Song, H. and Lakshman, T.V. (2009) Variable-Stride Multi-pattern Matching for Scalable Deep Packet Inspection. Proc. INFOCOM, Rio De Janeiro, Brazil, April 19-25, pp. 415-423. IEEE CS Press, Los Alamitos, CA.
26. Vespa, L., Weng, N. and Ramaswamy, R. (2011) MS-DFA: Multiple-stride pattern matching for scalable deep packet inspection. Comput. J., 54, 285-303.
27. Technical Report TR-94-17 (1994) A Fast Algorithm for Multipattern Searching. Department of Computer Science, University of Arizona. Tucson, Arizona.
28. Liu, R.T., Huang, N.F., Chen, C.H. and Kao, C.N. (2004) A fast string-matching algorithm for network processor-based intrusion detection system. ACM Trans. Embedded Comput. Syst., 3, 614-633.
29. Liu, R.T., Kao, C.N., Wu, H.S., Shih, M.C. and Huang, N.F. (2005) FTSE: The FNP-like TCAM Searching Engine. Proc. Symp. on Computers and Communications. Cartagena, Spain, June 27-30, pp. 863-868. IEEE CS Press, Los Alamitos, CA.
30. Pao, D., Lu, Z. and Poon, Y. H. (2012) IP address lookup using bit-shuffled trie. IEEE Trans. Comput., submitted for publication.
31. Martinez, C.J., Pandya, D.K. and Lin, W.M. (2009) On designing fast nonuniformly distributed IP address lookup hashing algorithms. IEEE/ACM Trans. Netw., 17, 1916-1925.