Scalable multi-pipeline architecture for high performance multi-pattern string matching

Multi-pattern string matching remains a major performance bottleneck in network intrusion detection and anti-virus systems for high-speed deep packet inspection (DPI). Although Aho-Corasick deterministic finite automaton (ACDFA) based solutions produce deterministic throughput and are widely used in today's DPI systems such as Snort [1] and ClamAV [2], the high memory requirement of AC-DFA (due to the large number of state transitions in AC-DFA) inhibits efficient hardware implementation to achieve high performance. Some recent work [3], [4] has shown that the AC-DFA can be reduced to a character trie that contains only the forward transitions by incorporating pipelined processing. But they have limitations in either handling long patterns or extensions to support multi-character input per clock cycle to achieve high throughput. This paper generalizes the problem and proves formally that a linear pipeline with H stages can remove all cross transitions to the top H levels of a ACDF...

• Type: Journal
• Year: 2010
• Where: IPPS
• Authors: Weirong Jiang, Yi-Hua Edward Yang, Viktor K. Prasanna
• Keywords: Distributed And Parallel Computing, IPPS 2010, Multi-character Input, Packet Inspection, String Matching