A GPU-Based Multiple-Pattern Matching Algorithm for Network Intrusion Detection Systems

Huang, Nen-Fu; Hung, Hsien-Wei; Lai, Sheng-Hung; Chu, Yen-Ming; Tsai, Wen-Fa

doi:10.1109/waina.2008.145

Cited by 50 publications

(29 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Specifically, they search for 16 different patterns in a packet in parallel employing 16 GPU cores. Huang et al [4] do network intrusion detection on a GPU based on the multipattern search algorithm of Wu and Manber [15]. Smith et al [12] use deterministic finite automata and extended deterministic finite automata to do regular expression matching on a GPU for intrusion detection applications.…”

Section: Introductionmentioning

confidence: 99%

Multipattern string matching on a GPU

Zha

Sahni

2011

2011 IEEE Symposium on Computers and Communications (ISCC)

View full text Add to dashboard Cite

Abstract-We develop GPU adaptations of the Aho-Corasick string matching algorithm for the two cases GPU-to-GPU and host-to-host. For the GPU-to-GPU case, we consider several refinements to a base GPU implementation and measure the performance gain from each refinement. For the host-to-host case, we analyze two strategies to communicate between the host and the GPU and show that one is optimal with respect to run time while the other requires less device memory. Experiments conducted on an NVIDIA Tesla GT200 GPU that has 240 cores running off of a Xeon 2.8GHz quad-core host CPU show that, for the GPU-to-GPU case, our Aho-Corasick GPU adaptation achieves a speedup between 8.5 and 9.5 relative to a singlethread CPU implementation and between 2.4 and 3.2 relative to the best multithreaded implementation. For the host-to-host case, the GPU AC code achieves a speedup of 3.1 relative to a singlethreaded CPU implementation. However, the GPU is unable to deliver any speedup relative to the best multithreaded code running on the quad-core host. In fact, the measured speedups for the latter case ranged between 0.74 and 0.83.

show abstract

Section: Introductionmentioning

confidence: 99%

Multipattern string matching on a GPU

Zha

Sahni

2011

2011 IEEE Symposium on Computers and Communications (ISCC)

View full text Add to dashboard Cite

show abstract

“…In [6], a GPU parallelised architecture based on the Wu-Manber algorithm is shown. The work in [6] was subsequently improved in [7], where a hierarchical parallel machine architecture on GPU was used to address some of the shortcomings revealed in [6], mainly the problem of state explosion that appears when it is necessary to search for complex regular expressions.…”

Section: Gpusmentioning

confidence: 99%

A Bloom Filter-Based Monitoring Station for a Lawful Interception Platform

Santos

Hernández

Urueña

et al. 2014

Communications in Computer and Information Science

View full text Add to dashboard Cite

Abstract. Lawful Interception (LI) is a fundamental tool in today's Police investigations.Therefore, it is important to make it as quickly and securely as possible as well as a reasonable cost per suspect. This makes traffic capture in aggregation links quite attractive, although this implies high wirespeeds which require the use of specific hardware-based architectures. This paper proposes a novel Bloom Filter-based monitoring station architecture for efficient packet capture in aggregation links. With said Bloom filter, we filter out most of the packets in the link and capture only those belonging to lawful interception wiretaps. Next, we present an FPGA-based implementation of said architecture and obtain the maximum capture rate achievable by injecting traffic through four parallel Gigabit Ethernet lines. Finally, we identify the limitations of our current design and suggest the possibility of further extending it to higher wirespeeds.

show abstract

“…Many attempts have been made to use graphics processors for security applications, including cryptography [11,8], data carving [17], and intrusion detection [14,30,10,27,13]. In our previous work [30], we extended Snort to offload the string matching operations of the Snort IDS to the GPU, offering a three times speedup to the processing throughput compared to a CPU-only implementation.…”

Section: Related Workmentioning

confidence: 99%

Regular Expression Matching on Graphics Hardware for Intrusion Detection

Vasiliadis

Polychronakis

Antonatos

et al. 2009

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The expressive power of regular expressions has been often exploited in network intrusion detection systems, virus scanners, and spam filtering applications. However, the flexible pattern matching functionality of regular expressions in these systems comes with significant overheads in terms of both memory and CPU cycles, since every byte of the inspected input needs to be processed and compared against a large set of regular expressions. In this paper we present the design, implementation and evaluation of a regular expression matching engine running on graphics processing units (GPUs). The significant spare computational power and data parallelism capabilities of modern GPUs permits the efficient matching of multiple inputs at the same time against a large set of regular expressions. Our evaluation shows that regular expression matching on graphics hardware can result to a 48 times speedup over traditional CPU implementations and up to 16 Gbit/s in processing throughput. We demonstrate the feasibility of GPU regular expression matching by implementing it in the popular Snort intrusion detection system, which results to a 60% increase in the packet processing throughput.

show abstract

A GPU-Based Multiple-Pattern Matching Algorithm for Network Intrusion Detection Systems

Cited by 50 publications

References 1 publication

Multipattern string matching on a GPU

Multipattern string matching on a GPU

A Bloom Filter-Based Monitoring Station for a Lawful Interception Platform

Regular Expression Matching on Graphics Hardware for Intrusion Detection

Contact Info

Product

Resources

About