Head-body partitioned string matching for Deep Packet Inspection with scalable and attack-resilient performance

Abstract--Dictionary-based string matching (DBSM) is a critical component of Deep Packet Inspection (DPI), where thousands of malicious patterns are matched against high-bandwidth network traffic. Deterministic finite automata constructed with the Aho-Corasick algorithm (AC-DFA) have been widely used for solving this problem. However, the state transition table (STT) of a large-scale DBSM AC-DFA can span hundreds of megabytes of system memory, whose limited bandwidth and long latency could become the performance bottleneck We propose a novel partitioning algorithm which converts an AC-DFA into a "head" and a "body" parts. The head part behaves as a traditional ACDFA that matches the pattern prefixes up to a predefined length; the body part extends any head match to the full pattern length in parallel body-tree traversals. Taking advantage of the SIMD instructions in modern x86-64 multi-core processors, we design compact and efficient data structures packing multi-pa...

• Type: Journal
• Year: 2010
• Where: IPPS
• Authors: Yi-Hua E. Yang, Viktor K. Prasanna, Chenqian Jiang
• Keywords: Deep Packet Inspection, Distributed And Parallel Computing, IPPS 2010, Parallel Body-tree Traversals, X86-64 Multi-core Processors