Sciweavers

Share
JSAC
2006

Fast and Scalable Pattern Matching for Network Intrusion Detection Systems

8 years 6 months ago
Fast and Scalable Pattern Matching for Network Intrusion Detection Systems
High-speed packet content inspection and filtering devices rely on a fast multi-pattern matching algorithm which is used to detect predefined keywords or signatures in the packets. Multi-pattern matching is known to require intensive memory accesses and is often a performance bottleneck. Hence specialized hardware-accelerated algorithms are required for line-speed packet processing. We present hardware-implementable pattern matching algorithm for content filtering applications, which is scalable in terms of speed, the number of patterns and the pattern length. Our algorithm is based on a memory efficient multi-hashing data structure called Bloom filter. We use embedded on-chip memory blocks in FPGA/VLSI chips to construct Bloom filters which can suppress a large fraction of memory accesses and speed up string matching. Based on this concept, we first present a simple algorithm which can scan for several thousand short (up to 16 bytes) patterns at multi-gigabit per second speeds with a ...
Sarang Dharmapurikar, John W. Lockwood
Added 13 Dec 2010
Updated 13 Dec 2010
Type Journal
Year 2006
Where JSAC
Authors Sarang Dharmapurikar, John W. Lockwood
Comments (0)
books