Advertisement

High Performance Regular Expression Matching on FPGA

  • Jiajia Yang
  • Lei JiangEmail author
  • Xu Bai
  • Qiong Dai
Conference paper
Part of the Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering book series (LNICST, volume 252)

Abstract

Deep Packet Inspection (DPI) technology has been widely deployed in Network Intrusion Detection System (NIDS) to detect attacks and viruses. State-of-the-art NIDS uses Deterministic Finite Automata (DFA) to perform regular expression matching for its stable matching speed. However, traditional DFA algorithm’s throughput is limited by the input character’s width (usually one character per time). In this paper, we present an architecture named Parallel-DFA to accelerate regular expression matching by scanning multiple characters per time. Experimental results show that, our architecture can achieve as high as 1200 Gbps (1.17 Tbps) rate on current single Field-Programmable Gate Array (FPGA) chip. This makes it a very practical solution for NIDS in 100G Ethernet standard network, which is currently the fastest approved standard of Ethernet. To the best of our knowledge, this is the fastest matching performance architecture on a single FPGA chip. Besides, the throughput is nearly 3 orders of magnitude (916\(\times \)) than that of original DFA implemented on software. Our architecture is about 183.2\(\times \) efficiency than that of original DFA.

Keywords

Deep Packet Inspection Regular expression matching DFA FPGA Network security 

Notes

Acknowledgment

Supported by the National Science and Technology Major Project under Grant No. 2017YFB0803003, the National Science Foundation of China (NSFC) under grant No. 61402475.

References

  1. 1.
    Dubrawsky, I.: Firewall evolution-deep packet inspection. In: Security Focus, vol. 29 (2003)Google Scholar
  2. 2.
    Hopcroft, J.E.: Introduction to Automata Theory, Languages, and Computation. Pearson Education India (1979)Google Scholar
  3. 3.
    Kumar, S., Dharmapurikar, S., Yu, F., Crowley, P., Turner, J.: Algorithms to accelerate multiple regular expressions matching for deep packet inspection. ACM SIGCOMM Comput. Commun. Rev. 36(4), 339–350 (2006)CrossRefGoogle Scholar
  4. 4.
    Becchi, M., Crowley, P.: A-DFA: a time-and space-efficient DFA compression algorithm for fast regular expression evaluation. ACM Trans. Arch. Code Optim. (TACO) 10(1), 4 (2013)Google Scholar
  5. 5.
    Jiang, L., Dai, Q., Tang, Q., Tan, J., Fang, B.: A fast regular expression matching engine for NIDS applying prediction scheme. In: IEEE Symposium on Computers and Communication (ISCC), pp. 1–7. IEEE (2014)Google Scholar
  6. 6.
    Brodie, B.C., Taylor, D.E., Cytron, R.K.: A scalable architecture for high-throughput regular-expression pattern matching. ACM SIGARCH Comput. Arch. News 34(2), 191–202 (2006)CrossRefGoogle Scholar
  7. 7.
    Van Lunteren, J., Rohrer, J., Atasu, K., Hagleitner, C.: Regular expression acceleration at multiple tens of Gb/s. In: 1st Workshop on Accelerators for High-performance Architectures in conjunction with ICS 2009 (2009)Google Scholar
  8. 8.
    Meiners, C.R., Patel, J., Norige, E., Liu, A.X., Torng, E.: Fast regular expression matching using small TCAM. IEEE/ACM Trans. Netw. (TON) 22(1), 94–109 (2014)CrossRefGoogle Scholar
  9. 9.
    Becchi, M., Crowley, P.: Efficient regular expression evaluation: theory to practice. In: Proceedings of the 4th ACM/IEEE Symposium on Architectures for Networking and Communications Systems, pp. 50–59. ACM (2008)Google Scholar
  10. 10.
    Prithi, S.. Sumathi, S.: Review on grouping algorithms for finite state automata (2016)Google Scholar
  11. 11.
    The Bro Network Security Monitor. http://www.bro.org
  12. 12.
    Roesch, M.: Snort: lightweight intrusion detection for networks. LISA 99(1), 229–238 (1999)MathSciNetGoogle Scholar
  13. 13.
    Wang, L., Chen, S., Tang, Y., Su, J.: Gregex: GPU based high speed regular expression matching engine. In: 2011 Fifth International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing (IMIS), pp. 366–370. IEEE (2011)Google Scholar

Copyright information

© ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering 2018

Authors and Affiliations

  1. 1.School of Cyber Security, Institute of Information EngineeringUniversity of Chinese Academy of Sciences, UCASBeijingPeople’s Republic of China

Personalised recommendations