Two-Phase PFAC Algorithm for Multiple Patterns Matching on CUDA GPUs

Abstract

The rapid advancement of high speed networks has resulted in a significantly increasing number of network packets per second nowadays, implying network intrusion detection systems (NIDSs) need to accelerate the inspection of packet content to protect the computer systems from attacks. On average, the pattern matching process in a NIDS consumes approximately 70% of the overall processing time. The conventional Aho–Corasick (AC) algorithm, adopting a finite state machine to identify attack patterns in NIDSs, is too slow to meet the requirement of high speed networks. In view of this, several studies have used the features of a graphics processing unit (GPU) to improve the core searching process of the AC algorithm. For instance, parallel failureless Aho-Corasick (PFAC) algorithm improves the process of pattern matching effectively by removing backward branches in the original finite state machine created using the AC algorithm. In this way, boundary detection can be avoided totally if we allocate an individual thread to each byte of an input stream to identify any pattern starting at the thread’s starting position. However, through analysis, we found that this algorithm experiences a serious load imbalance problem. Therefore, this paper proposes a two-phase PFAC algorithm to address the problem. A threshold is predefined to divide execution into two phases, and the failureless finite state machine is also decoupled into two parts accordingly. In the first phase, every thread identifies patterns by running the tiny part of the decoupled failureless finite state machine that are stored in fast shared memory. In the second phase, all the threads requiring further searching in a same block are regrouped into a few warps for less branch divergence. According to experimental results, the proposed algorithm shows a performance improvement of 50% compared to the PFAC algorithm.

A GPU-assisted NFV framework for intrusion detection system

“…The concept of GPGPU was introduced in 2001 with support to floating-point operations in GPUs as a way to compute anything other than graphic operations. In 2006, NVIDIA released the compute unified device architecture (CUDA), enabling code execution on GPUs without requiring full and explicit conversion of the data to/from a graphical form [20]. This architecture is the main enabler of the recent advances in several areas, such as the 6 training of large-scale ML models.…”

Multiple exact string matching algorithm based on q-gram hash comparison for DNA sequences

“…Çoklu desen eşleştirmede arama süresini kısaltmak için literatürde cuckoo filtrelemeye dayalı çoklu desen eşleştirme algoritmalarının paralelleştirilmesi [7], Rabin Karp algoritmasının paralelleştirilmesi [8], iki aşamalı paralel çoklu desen eşleştirme algoritması [9], Boyer-Moore-Horspool algoritmasına dayalı paralel çoklu dizi eşleştirme algoritmasının geliştirilmesi [10] ve mükemmel hash fonksiyonunu kullanarak GPU üzerinde paralel çoklu dizi eşleştirme algoritmalarının geliştirilmesi [11] gibi paralel programlama destekli birçok çalışma gerçekleştirilmiştir.…”