Time and area efficient pattern matching on FPGAs

Abstract

Pattern matching for network security and intrusion detection demands exceptionally high performance. Much work has been done in this field, and yet there is still significant room for improvement in efficiency, flexibility, and throughput. We develop a novel linear-array string matching architecture using a buffered, two-comparator variation on the Knuth-Morris-Pratt(KMP) algorithm. For small (16 or fewer characters) patterns, it compares favorably with the state-of-the-art while providing better scalability and reconfiguration, and more efficient hardware utilization.KMP is a well-known, efficient string matching technique using a single comparator and a precomputed transition table. We add a second comparator and an input buffer, allowing the system to accept at least one character in each cycle and terminate after a number of clock cycles at maximum equal to the length of the input string plus the size of the buffer. The system also provides a clean, modular route to reconfiguring the patterns on-the-fly and scaling the system to support more units, using several rows of linear array elements. In this paper, we prove the bound on the buffer size and running time, and provide performance comparisons against other approaches.

A Dynamically Reconfigurable FPGA-Based Pattern Matching Hardware for Subclasses of Regular Expressions

“…As results, for STR, we could install 256 patterns and achieve the throughput of 2.6 Gbps on Xilinx Virtex-5 LX330, and for EXT, we could install 128 patterns and achieve the throughput of 1.4 Gbps on the same device. Next, we compared the performances of our hardwares for both STR and EXT to those of the previous dynamically reconfigurable hardwares in the literatures [3], [4], [8] after a calibration of throughputs using process scaling in CMOS technologies that FPGA devices were built on. Consequently, our hardwares for both classes were comparable to those of the above dynamically reconfigurable hardwares in their performances.…”

“…A recent research trend in large-scale regular expression matching hardwares is to simulate finite state automata for a class of regular expressions on a specially designed hardware [3], [4], [8], [13], [19], [20], [24]- [26]. This approach is further classified into the static compilation approach and the dynamic reconfiguration approach.…”

“…In the dynamic reconfiguration approach [3], [4], [8], [13], a universal control logic is statically compiled into FPGA beforehand as well, but a description of regular expressions is dynamically loaded to the FPGA as data in preprocessing, and then simulated in run-time. This approach is attractive in real-world applications such as ESP and NIDS, where input patterns frequently change.…”

“…Overall, our research goal is to design dynamically re- configurable hardwares for complex classes of regular expressions and to achieve gigabit throughput as the hardwares by [3], [4], [6], [8], [14], [21].…”

“…Such hardwares are desired to have the capability of on-the-fly reconfiguration of patterns as well as highperformance guarantee for a wide class of regular expressions. However, most of the currently available dynamically reconfigurable hardwares [4], [8] can deal with only exact string patterns. Interestingly enough, we can observe that most of detection rules are either extended patterns in EXT, which will be considered in this paper, or disjunctions of a few extended patterns.…”