SPC-FA: synergic parallel compact finite automaton to accelerate multi-string matching with low memory

Deterministic Finite Automaton (DFA) is well-known for its constant matching speed in worst case, and widely used in multistring matching, which is a critical technique in high performance Network Intrusion Detection System (NIDS) design. Existing DFA-based researches achieve high throughput at the expense of extremely high memory cost, so they fail to be used in situations like embedded systems where very tight memory resource is available. In this paper, we propose a memory-efficient multistring matching acceleration scheme named Synergic Parallel Compact (SPC) Match Engine, which can provide a high matching speedup with no extra memory cost than the traditional DFA. Our scheme can be understood as consisting of k SPC-FAs, each of which can process one character from the input stream, causing achieving a constant speedup factor k with reduced memory occupation. Experimental evaluations with Snort and ClamAV rulesets show that a speedup of 9X can be practically achieved by a single S...

• Type: Journal
• Year: 2009
• Where: ANCS
• Authors: Junchen Jiang, Yi Tang, Bin Liu, Xiaofei Wang, Yang Xu
• Keywords: ANCS 2009, Computer Networks, Match Engine, Network Intrusion Detection System, Reduced Memory