Speculative parallel pattern matching using stride-k DFA for deep packet inspection

Najam, Maleeha; Younis, Usman; Rasool, Raihan Ur

doi:10.1016/j.jnca.2015.04.013

Cited by 22 publications

(8 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These algorithms are classified as a string matching, in which the patterns are represented as a set of strings, or RMT, in which the patterns are specified as regular expressions [22,23].…”

Section: Deep Pimentioning

confidence: 99%

Fast 2D filter with low false positive for network packet inspection

Shubbar¹,

Ahmadi²

2017

IET Networks

View full text Add to dashboard Cite

Deep packet inspection (DPI) represents the major process in network intrusion detection and prevention systems. In DPI each security threat is represented as a signature, and the payload of every incoming data packet is matched against the set of current signatures. Moreover, DPI is also used for other networking applications such as packet classification, quality of service techniques, protocol identification and so on. DPI exhausts extra central processing unit and memory resources, and as a result, several attempts have been proposed to improve this process. In this study, the authors proposed a fast twodimensional (2D) filter with low false positive (FP) rate for DPI purposes. It consists of 2D array that employs single hash function and has very low FP rate. Using this filter as an identification tool in a DPI technique will result in more accurate and higher throughput than other systems that employ Bloom (BFs) and quotient filters (QFs). Our experiments show that the proposed solution has time improvement up to 94% over others that employ BFs or QFs and the achieved average throughput is 1.8 Gbps.

show abstract

Section: Deep Pimentioning

confidence: 99%

Fast 2D filter with low false positive for network packet inspection

Shubbar¹,

Ahmadi²

2017

IET Networks

View full text Add to dashboard Cite

show abstract

“…Najam et al . present a speculative parallel pattern matching technique for processing multiple stride DFAs, and a transition compression table technique is used to reduce 65% transitions of stride DFAs compared with the original DFA. Yang et al .…”

Section: Related Workmentioning

confidence: 99%

“…J-DFA applies a next-state prediction strategy and FPGA hardware implementation to speed up the compressed DFA matching engine. Najam et al [15] present a speculative parallel pattern matching technique for processing multiple stride DFAs, and a transition compression table technique is used to reduce 65% transitions of stride DFAs compared with the original DFA. Yang et al propose a PEDFA [16] to compress the DFA's transition matrix on ternary content-addressable memories (TCAMs) to reduce memory and power consumption.…”

Section: Related Workmentioning

confidence: 99%

RICS‐DFA: a space and time‐efficient signature matching algorithm with Reduced Input Character Set

Tang

Jiang

Dai

et al. 2016

Concurrency and Computation

View full text Add to dashboard Cite

Summary Regular expression matching as a core component of deep packet inspection is widely used in various kinds of modern network intrusion detection system, traffic classification system, network monitoring system, and so on. In these systems, regular expressions are typically converted to a deterministic finite automaton (DFA), which takes O(1) to scan each input character. However, DFA generally consumes a large amount of memory. This paper proposes a novel, space‐efficient and time‐efficient DFA presentation, called reduced input character set DFA (RICS‐DFA). A character escaping and replacing scheme is first introduced to decrease the size of DFA's character set and then to reduce DFA's space requirement with a series of optimization techniques. Based on transition rewriting, a RICS‐DFA constructing algorithm with time complexity of O(n) is presented in this paper. For real rule‐sets, RICS‐DFA reduces the memory consumption by 68–92%, compared with the original DFA. Finally, this paper designs a scalable RICS‐DFA matching engine on field‐programmable gate array platform in which the reduced state transition matrix is mapped to on‐chip memories. The throughput of executing deep packet inspection for real rule‐sets can achieve 7–50.5 Gbps. Copyright © 2016 John Wiley & Sons, Ltd.

show abstract

“…Deep Packet Inspection is a method used to perform thorough inspection process in the packet header of the TCP / IP and Payload. Some previous researches conducted by [10], [11] and [12] have been using the DPI as a method for packet classification process incoming and outgoing data…”

Section: Overview and Background Problemsmentioning

confidence: 99%