High Performance Regular Expression Matching on FPGA
Deep Packet Inspection (DPI) technology has been widely deployed in Network Intrusion Detection System (NIDS) to detect attacks and viruses. State-of-the-art NIDS uses Deterministic Finite Automata (DFA) to perform regular expression matching for its stable matching speed. However, traditional DFA algorithm’s throughput is limited by the input character’s width (usually one character per time). In this paper, we present an architecture named Parallel-DFA to accelerate regular expression matching by scanning multiple characters per time. Experimental results show that, our architecture can achieve as high as 1200 Gbps (1.17 Tbps) rate on current single Field-Programmable Gate Array (FPGA) chip. This makes it a very practical solution for NIDS in 100G Ethernet standard network, which is currently the fastest approved standard of Ethernet. To the best of our knowledge, this is the fastest matching performance architecture on a single FPGA chip. Besides, the throughput is nearly 3 orders of magnitude (916\(\times \)) than that of original DFA implemented on software. Our architecture is about 183.2\(\times \) efficiency than that of original DFA.
KeywordsDeep Packet Inspection Regular expression matching DFA FPGA Network security
Supported by the National Science and Technology Major Project under Grant No. 2017YFB0803003, the National Science Foundation of China (NSFC) under grant No. 61402475.
- 1.Dubrawsky, I.: Firewall evolution-deep packet inspection. In: Security Focus, vol. 29 (2003)Google Scholar
- 2.Hopcroft, J.E.: Introduction to Automata Theory, Languages, and Computation. Pearson Education India (1979)Google Scholar
- 4.Becchi, M., Crowley, P.: A-DFA: a time-and space-efficient DFA compression algorithm for fast regular expression evaluation. ACM Trans. Arch. Code Optim. (TACO) 10(1), 4 (2013)Google Scholar
- 5.Jiang, L., Dai, Q., Tang, Q., Tan, J., Fang, B.: A fast regular expression matching engine for NIDS applying prediction scheme. In: IEEE Symposium on Computers and Communication (ISCC), pp. 1–7. IEEE (2014)Google Scholar
- 7.Van Lunteren, J., Rohrer, J., Atasu, K., Hagleitner, C.: Regular expression acceleration at multiple tens of Gb/s. In: 1st Workshop on Accelerators for High-performance Architectures in conjunction with ICS 2009 (2009)Google Scholar
- 9.Becchi, M., Crowley, P.: Efficient regular expression evaluation: theory to practice. In: Proceedings of the 4th ACM/IEEE Symposium on Architectures for Networking and Communications Systems, pp. 50–59. ACM (2008)Google Scholar
- 10.Prithi, S.. Sumathi, S.: Review on grouping algorithms for finite state automata (2016)Google Scholar
- 11.The Bro Network Security Monitor. http://www.bro.org
- 13.Wang, L., Chen, S., Tang, Y., Su, J.: Gregex: GPU based high speed regular expression matching engine. In: 2011 Fifth International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing (IMIS), pp. 366–370. IEEE (2011)Google Scholar