Deep Payload Inspection systems like SNORT and BRO utilize regular expression for their rules due to their high expressibility and compactness. The SNORT IDS system uses the PCRE Engine for regular expression matching on the payload. The software based PCRE Engine utilizes an NFA engine based on certain opcodes which are determined by the regular expression operators in a rule. Each rule in the SNORT ruleset is translated by PCRE compiler into an unique regular expression engine. Since the software based PCRE engine can match the payload with a single regular expression at a time, and needs to do so for multiple rules in the ruleset, the throughput of the SNORT IDS system dwindles as each packet is processed through a multitude of regular expressions.In this paper we detail our implementation of hardware based regular expression engines for the SNORT IDS by transforming the PCRE opcodes generated by the PCRE compiler from SNORT regular expression rules. Our compiler generates VHDL code corresponding to the opcodes generated for the SNORT regular expression rules. We have tuned our hardware implementation to utilize an NFA based regular expression engine, using greedy quantifiers, in much the same way as the software based PCRE engine. Our system implements a regular expression only once for each new rule in the SNORT ruleset, thus resulting in a fast system that scales well with new updates. We implement two hundred PCRE engines based on a plethora of SNORT IDS rules, and use a Virtex-4 LX200 FPGA, on the SGI RASC RC 100 Blade connected to the SGI ALTIX 4700 supercomputing system as a testbed. We obtain an interface throughput of (12.9 GBits/s) and also a maximum speedup of 353X over software based PCRE execution.

In this paper, we propose an adoplivc scan (AS) strategy for submesh allocation. The earlierframe sliding (FS) strategy [I] allocates submeshes based on fixed orientations of incoming faska. It also slides fiunaes om mesh planes by fdzed strides. Our AS a1Iocation strategy diflers from the FS slrafegy in the following two ways: (1) it does not jiz the orientations of incoming tasks;(2) it scans on mesh planes adapfively. Experimental studies show that oar AS strategy oedperfornas the FS slmdegy in t e m s of external fmgmentaiion, completion la'nae, land processor uii/izaiion.

No abstract

No abstract

No abstract