A Pattern Partitioning Algorithm for Memory-Efficient Parallel String Matching in Deep Packet Inspection

Abstract

This paper proposes a pattern partitioning algorithm that maps multiple target patterns onto homogeneous memory-based string matchers. The proposed algorithm adopts the greedy search based on lexicographical sorting. By mapping as many target patterns as possible onto each string matcher, the memory requirements are greatly reduced.

An iterative pattern mapping for parallel string matching architecture in intrusion detection systems

“…For the apple-to-apple comparisons, the pattern mapping using the lexicographical pattern order [2], which was denoted as lexical, was implemented. In addition, the pattern mapping approaches with the random sorting, gray code-based sorting in [3], and greedy search [4] were evaluated, which were denoted as random, gray, and heuristic, respectively. In addition, the pattern mapping that balanced the number of mapped patterns between string matchers [5] was denoted as metric.…”

“…In the existing pattern mapping approaches of [2,3,4,5], the target patterns are mapped based on the predetermined order; if a pattern cannot be mapped onto a string matcher, it is mapped onto another new empty string matcher. For example, let us assume that a string matcher has an FSM with eight input bits and eight states.…”

“…In addition, "abc", "bcd", "bcdef", and "defg" are assumed to be a set of lexicographically sorted target patterns. After mapping the target patterns on the pattern mapping approaches in [2,3,4], three string matchers are required as follows:…”

“…In the parallel string matching architecture, the memory requirements can be decreased by reducing the required number of string matchers. However, because the existing pattern mapping approaches in [2,3,4,5] were based on the determined order, the required number of string matchers was not fully optimized.…”

A Memory-Efficient Two-Stage String Matching Engine Using both Content-Addressable Memory and Bit-split String Matchers for Deep Packet Inspection

“…The required numbers of string matchers in the second stage were reduced by 27.9%-15.1%, 26.0%-12.3%, 19.0%-10.8%, and 10.5%-2.7%, compared to the cases of origin, origing, lexical, and lexicalg, respectively. Therefore, it was concluded that the number of string matchers in the second stage was decreased by applying the heuristic algorithm in [11] without additional hardware. In order to know the performance of the proposed string matching engine, when CAM width was 8, the main blocks were implemented using an Xilinx field programmable gate array (FPGA) [13] .…”