Optimization of Pattern Matching Circuits for Regular Expression on FPGA

Lin, Cheng-Hung; Huang, Chih-Tsun; Jiang, Chang-Ping; Chang, Shih-Chieh

doi:10.1109/tvlsi.2007.909801

Cited by 74 publications

(49 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Sidhu and Prasanna [20] later proposed to construct NFA-based REM circuits on fieldprogrammable gate arrays (FPGA) [20]. Optimizations such as input/output pipelining [11], common-prefix extraction [8,11], temporal [24] and spatial [25] multi-character matching, and centralized [8,15] and memory-assisted [25] character decoding, were applied to further improve the matching throughput and resource utilization. While achieving high matching throughput (~10 Gbps) over large number (>1k) of patterns, the Achilles' heel of NFA-based REM on FPGA is the difficult circuit-based implementation.…”

Section: Related Workmentioning

confidence: 99%

Optimizing Regular Expression Matching with SR-NFA on Multi-Core Systems

Yang

Prasanna

2011

2011 International Conference on Parallel Architectures and Compilation Techniques

View full text Add to dashboard Cite

Abstract-Conventionally, regular expression matching (REM) has been performed by sequentially comparing the regular expression (regex) to the input stream, which can be slow due to excessive backtracking [21]. Alternatively, the regex can be converted to a deterministic finite automaton (DFA) for efficient matching, which however may require an extremely large state transition table (STT) due to exponential state explosion [17,27]. We propose the segmented regex-NFA (SR-NFA) architecture, where the regex is first compiled into modular nondeterministic finite automata (NFA), then partitioned, optimized, and matched efficiently on modern multi-core processors. SR-NFA offers attack-resilient multi-gigabit per second matching throughput, does not suffer from either backtracking or state explosion, and can be rapidly constructed. For regex sets that construct a DFA with moderate state explosion, i.e., on average 200k states in the STT, the proposed SR-NFA is 367k times faster to construct and update and use 23k times less memory than the DFA approach. Running on an 8-core 2.6 GHz Opteron platform, our prototype achieves 2.2 Gbps average matching throughput for regex sets with up to 4,000 SR-NFA states per regex set.

show abstract

Section: Related Workmentioning

confidence: 99%

Optimizing Regular Expression Matching with SR-NFA on Multi-Core Systems

Yang

Prasanna

2011

2011 International Conference on Parallel Architectures and Compilation Techniques

View full text Add to dashboard Cite

show abstract

“…Hutchings et al [7] implemented a module to extract patterns from the SNORT rule set [14] and then generated their regular expressions for NFA realization. Lin et al applied minimization to the regular expressions for resource sharing [13]. To reduce data transfer widths, an 8-bit character decoder provides 256 unique outputs; various designs [5,6,7,8,9] were implemented.…”

Section: Related Workmentioning

confidence: 99%

Efficient hardware support for pattern matching in network intrusion detection

Guinde

Ziavras

2010

Computers & Security

View full text Add to dashboard Cite

Abstract-Deep packet inspection forms the backbone of any Network Intrusion Detection (NID) system. It involves matching known malicious patterns against the incoming traffic payload. Pattern matching in software is prohibitively slow in comparison to current network speeds. Due to the high complexity of matching, only FPGA (Field-Programmable Gate Array) or ASIC (Application-Specific Integrated Circuit) platforms can provide efficient solutions. FPGAs facilitate target architecture specialization due to their field programmability. Costly ASIC designs, on the other hand, are normally resilient to pattern updates. Our FPGA-based solution performs high-speed pattern matching while permitting pattern updates without resource reconfiguration. To its advantage, our solution can be adopted by software and ASIC realizations, however at the expense of much lower performance and higher price, respectively. Our solution permits the NID system to function while pattern updates occur. An off-line optimization method first finds common subpatterns across all the patterns in the SNORT database of signatures [14]. A novel technique then compresses each pattern into a bit vector, where each bit represents such a sub-pattern. This approach reduces drastically the required on-chip storage as well as the complexity of pattern matching. The bit vectors for newly discovered patterns can be generated easily using a simple high-level language program before storing them into the on-chip RAM. Compared to earlier approaches, not only is our strategy very efficient while supporting runtime updates but it also results in impressive area savings; it utilizes just 0.052 logic cells for processing and 17.77 bits for storage per character in the current SNORT database of 6455 patterns. Also, the total number of logic cells for processing the traffic payload does not change with pattern updates.

show abstract

“…Hutchings et al [8] implemented a module to extract patterns from the SNORT rule set [17] and then generated their regular expressions for NFA realization. Lin et al applied minimization to regular expressions for resource sharing [16]. To reduce transfer widths, an 8-bit character decoder provides 256 unique outputs; various designs (see [6], [7], [8], [9] and [10]) were implemented.…”

Section: Related Workmentioning

confidence: 99%

Novel FPGA-Based Signature Matching for Deep Packet Inspection

Guinde

Ziavras

2010

Information Security Theory and Practices. Security and Privacy of Pervasive Systems and Smart Devices

View full text Add to dashboard Cite

Abstract. Deep packet inspection forms the backbone of any Network Intrusion Detection (NID) system. It involves matching known malicious patterns against the incoming traffic payload. Pattern matching in software is prohibitively slow in comparison to current network speeds. Thus, only FPGA (Field-Programmable Gate Array) or ASIC (ApplicationSpecific Integrated Circuit) solutions could be efficient for this problem. Our FPGA-based solution performs high-speed matching while permitting pattern updates without resource reconfiguration. An off-line optimization method first finds sub-pattern similarities across all the patterns in the SNORT database of signatures [17]. A novel technique then compresses each pattern into a bit vector where each bit represents such a sub-pattern. Our approach reduces drastically the required on-chip storage as well as the complexity of matching, utilizing just 0.05 logic cells for processing and 17.74 bits for storage per character in the current SNORT database of 6456 patterns.

show abstract

Optimization of Pattern Matching Circuits for Regular Expression on FPGA

Cited by 74 publications

References 12 publications

Optimizing Regular Expression Matching with SR-NFA on Multi-Core Systems

Optimizing Regular Expression Matching with SR-NFA on Multi-Core Systems

Efficient hardware support for pattern matching in network intrusion detection

Novel FPGA-Based Signature Matching for Deep Packet Inspection

Contact Info

Product

Resources

About