Fast Scalable Automaton Matching Hardware for Content Filtering Systems

1
Fast Scalable Automaton Matching Hardware for
Content Filtering Systems
Student Kun-Kuo Tseng???????
Advisor Ying-Dar Lin???????

• Abstract
• Home and office network gateways often employ a
  cost-effective embedded network processor to
  handle their network services. Such network
  gateways have received strong demand for
  empowering content filtering services, e.g.,
  intrusion detection, keyword blocking, anti-virus
  and anti-spam. Accordingly, we were motivated to
  propose an appropriate fast scalable automaton
  matching (FSAM) hardware for accelerating the
  embedded network processors. In our observation,
  although automaton matching algorithms are robust
  with deterministic matching time, there is still
  plenty of room for improving its average-case
  performance. Our FSAM employs novel pre-hashing
  and root-indexing techniques to accelerate the
  non-root state and root state, respectively, in
  automation based hardware. In our embodiment,
  FSAM is implemented in a prevalent automaton
  algorithm, Aho-Corasick (AC), which is often used
  in many content filtering applications. In our
  evaluation, FPGA implementation of FSAM can
  perform at the rate of 11.1 giga bit per second
  with the pattern sets in 22,563 bytes,
  significantly superior to the previous matching
  hardware. Furthermore, the pattern sets of FSAM
  are not limited by the amount of FPGA circuits
  and memories. If the external memories are
  employed, our FSAM can support up to 21,302
  patterns while maintaining similar high
  performance.
• Motivation
• Malicious traffic is wild and out of control in
  Internet realm
• Matching is a bottleneck in content filtering
  system
• Thus, we desiderate a fast and robust hardware
• Existed Works
• Cannot be fast while handle large patterns
• Cannot be fast in both average and worst cases
• Proposed Novel Ideas
• Deterministic automata match with fast average
  time
• Pre-Hashing and Parallel-Indexing Techniques
• Evaluation
• Real Patterns Virus URLs

System Architecture Multi-bytes matching
acceleration in deterministic automaton
FPGA Implementation Fast engine and scalable to
use external memory for handle large patterns
Fastest Performance
Support Largest Pattern
Low Circuit Usage
Evaluation Compared with 16 string matching
hardware
Our FSAM