A Parallel Automaton String Matching with Pre-Hashing and Root-Indexing Techniques for Content Filtering Coprocessor

Tseng, Kuo-Kun; Lin, Ying‐Dar; Lee, Tsern-Huei; Lai, Yuan‐Cheng

doi:10.1109/asap.2005.8

Cited by 6 publications

(2 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, this algorithm requires preprocessing the text, and thus is not suitable for real time matching. Hardware technologies for string matching are proposed to reduce string matching time, such as systolic array hardware [13], reconfigurable hardware [14], bloom filter [15], and content filtering coprocessor [16] and divided data parallel [17].…”

Section: Introductionmentioning

confidence: 99%

An Efficient String Matching Algorithm Using Bidirectional and Parallel Processing Structure for Intrusion Detection System

Chang¹

2010

KSII TIIS

View full text Add to dashboard Cite

Rapid growth of internet applications has increased the importance of intrusion detection system (IDS) performance. String matching is the most computation-consuming task in IDS. In this paper, a new algorithm for multiple string matching is proposed. This proposed algorithm is based on the canonical Aho-Corasick algorithm and it utilizes a bidirectional and parallel processing structure to accelerate the matching speed. The proposed string matching algorithm was implemented and patched into Snort for experimental evaluation. Comparing with the canonical Aho-Corasick algorithm, the proposed algorithm has gained much improvement on the matching speed, especially in detecting multiple keywords within a long input text string.

show abstract

Section: Introductionmentioning

confidence: 99%

An Efficient String Matching Algorithm Using Bidirectional and Parallel Processing Structure for Intrusion Detection System

Chang¹

2010

KSII TIIS

View full text Add to dashboard Cite

show abstract

“…The two reasons for this difference is again the use of CAM structures, but also the fact that we only process one character per cycle, while other proposed approaches process up to 4 characters per cycle. A compelling option to speed-up AC-based string search is to utilize fast predictions for the state transitions [ 18], and default in the relatively slow but compact state transitions only in the cases of mispredictions.…”

Section: Comparison To Related Workmentioning

confidence: 99%

A Memory-Efficient Reconfigurable Aho-Corasick FSM Implementation for Intrusion Detection Systems

Dimopoulos

Papaefstathiou

Pnevmatikatos

2007

2007 International Conference on Embedded Computer Systems: Architectures, Modeling and Simulation

View full text Add to dashboard Cite

Abstract-The Aho-Corasick (AC) algorithm is a very flexible and efficient but memory-hungry pattern matching algorithm that can scan the existence of a query string among multiple test strings looking at each character exactly once, making it one of the main options for software-base intrusion detection systems such as SNORT. We present the Split-AC algorithm, which is a reconfigurable variation of the AC algorithm that exploits domain-specific characteristics of Intrusion Detection to reduce considerably the FSM memory requirements. SplitAC achieves an overall reduction between 28-75% compared to the best proposed implementation.

show abstract

Concurrent workload mapping for multicore security systems

Soewito

Weng

2009

Concurrency and Computation

View full text Add to dashboard Cite

Multicore based network processors are promising components to build real-time and scalable security systems to protect the networks and systems. The parallel nature of the processing system makes it challenging for application developers to concurrently program security systems for high performance. In this paper we present an automatic programming methodology that considers application complexity, traffic variation, and attack signatures update. In particular, our mapping algorithm concurrently takes advantage of parallelism in the level of tasks, applications, and packets to achieve optimal performance. We present results that show the effectiveness of the analysis, mapping, and the performance of the model methodology. Figure 1. Methodology for workload profiling and mapping.Multicore-based network processors (NPs) represent a major evolution in computing hardware technology. Multicore provides an application with more processing power for exploiting the inherent parallelism in network processing. Packets that belong to different network connections can be processed independently as a TCP/IP network gives no guarantees on packet orders.However, with the current software development tools and methodologies, it is challenging to program an application for an NP. The multiprocessor nature of an NP requires that the application developer partition the application and allocate it to processing resources manually. To achieve better load balancing for higher throughput, this typically requires that parts of the application are programmed in assembly and fine-tuned for performance.In this paper, we have presented a concurrent workload mapping methodology for multicore security systems in Figure 1. Our workload analyzer considers application complexity, traffic variation, and attacks signature update. Our mapping algorithm concurrently takes advantage of parallelism in tasks, applications, and packets to achieve high performance. Our proposed methodology can be Existing intermediate representations of an NP applications require programmers to manually partition applications (e.g. communication-oriented data flow representation in NP-Click) or do not consider run-time information (e.g. call graphs). We address this problem with a 'bottom-up' approach that differs from the above work insofar that we use profiling information from a simple uniprocessor implementation of an NP application. This profiling information is represented as an annotated directed acyclic graph (aDAG), which can be used to extract all the available parallelism in the application, to map the application to processing resources, and to model the run-time performance through an analytic performance model. This bottom-up approach of analyzing and mapping workloads promises to significantly reduce the complexity with which the application developer has to deal.Mapping algorithms for assigning task graphs to multiprocessors has been surveyed by Kwok and Ahmad [9]. Mapping tasks to conventional multiprocessors has been done by Austin and Sohi [10], is co...

show abstract

A Parallel Automaton String Matching with Pre-Hashing and Root-Indexing Techniques for Content Filtering Coprocessor

Abstract: We

Cited by 6 publications

References 15 publications

An Efficient String Matching Algorithm Using Bidirectional and Parallel Processing Structure for Intrusion Detection System

An Efficient String Matching Algorithm Using Bidirectional and Parallel Processing Structure for Intrusion Detection System

A Memory-Efficient Reconfigurable Aho-Corasick FSM Implementation for Intrusion Detection Systems

Concurrent workload mapping for multicore security systems

Contact Info

Product

Resources

About