Deep packet inspection using parallel bloom filters

Dharmapurikar, Sarang; Krishnamurthy, Praveen Thaggikuppe; Sproull, Todd; Lockwood, John W.

doi:10.1109/mm.2004.1268997

Cited by 384 publications

(228 citation statements)

References 7 publications

Supporting

Mentioning

221

Contrasting

Unclassified

Order By: Relevance

“…The Bloom filter is widely used in many network applications, such as Web caching, P2P collaboration, network measurements and monitoring, and packet processing. For example, Dharmapurikar et al [34] proposed parallel Bloom filters to significantly improve the performance of DPI. Bonomi et al [4] proposed an approximate concurrent state machine, where d-left hashing and fingerprinting schemes [35] were used to build a stateful Bloom filter, thus achieving fast per-flow state lookups.…”

Section: Related Workmentioning

confidence: 99%

An index-split Bloom filter for deep packet inspection

Huang

Zhang

2010

Sci. China Inf. Sci.

View full text Add to dashboard Cite

Deep packet inspection (DPI) scans both packet headers and payloads to search for predefined signatures. As link rates and traffic volumes of Internet are constantly growing, DPI is facing the high performance challenge of how to achieve line-speed packet processing with limited embedded memory. The recent trie bitmap content analyzer (TriBiCa) suffers from high update overhead and many false positive memory accesses, while the shared-node fast hash table (SFHT) suffers from high update overhead and large memory requirements. This paper presents an index-split Bloom filter (ISBF) to overcome these issues. Given a set of off-chip items, an index of each item is split apart into several groups of constant bits, and each group of bits uses an array of on-chip parallel counting Bloom filters (CBFs) to represent the overall off-chip items. When an item is queried, several groups of on-chip parallel CBFs constitute an index of an off-chip item candidate for a match. Furthermore, we propose a lazy deletion algorithm and vacant insertion algorithm to reduce the update overhead of ISBF, where an on-chip deletion bitmap is used to update on-chip parallel CBFs, not adjusting other related off-chip items. The ISBF is a time/space-efficient data structure, which not only achieves O(1) average memory accesses of insertion, deletion, and query, but also reduces the memory requirements. Experimental results demonstrate that compared with the TriBiCa and SFHT, the ISBF significantly reduces the off-chip memory accesses and processing time of primitive operations, as well as both the on-chip and off-chip memory sizes.

show abstract

Section: Related Workmentioning

confidence: 99%

An index-split Bloom filter for deep packet inspection

Huang

Zhang

2010

Sci. China Inf. Sci.

View full text Add to dashboard Cite

show abstract

“…FPGAs have been proposed to match exact patterns with Bloom filters [13,30,45], CAMs [6,44], or Aho-Corasick automata [11,20,43], and to match regular expressions with direct hardware synthesis [20,28] or DFAs [31]. Most of these solutions are fast enough for use in a Network Intrusion Detection System, which filters incoming traffic at wire speed (several Gbps of throughput), although they usually exhibit a very limited dictionary capacity.…”

Section: Related Workmentioning

confidence: 99%

Top-Performance Tokenization and Small-Ruleset Regular Expression Matching

Scarpazza

2010

Int J Parallel Prog

View full text Add to dashboard Cite

In the last decade, the volume of unstructured data that Internet and enterprise applications create and consume has been growing at impressive rates. The tools we use to process these data are search engines, business analytics suites, natural-language processors and XML processors. These tools rely on tokenization, a form of regular expression matching aimed at extracting words and keywords in a character stream. The further growth of unstructured data-processing paradigms depends critically on the availability of high-performance tokenizers. Despite the impressive amount of parallelism that the multi-core revolution has made available (in terms of multiple threads and wider SIMD units), most applications employ tokenizers that do not exploit this parallelism. I present a technique to design tokenizers that exploit multiple threads and wide SIMD units to process multiple independent streams of data at a high throughput. The technique benefits indefinitely from any future scaling in the number of threads or SIMD width. I show the approach's viability by presenting a family of tokenizer kernels optimized for the Cell/B.E. processor that deliver a performance seen, so far, only on dedicated hardware. These kernels deliver a peak throughput of 14.30 Gbps per chip, and a typical throughput of 9.76 Gbps on Wikipedia input. Also, they achieve almost-ideal resource utilization (99.2%). The approach is applicable to any SIMD enabled processor and matches well the trend toward wider SIMD units in contemporary architecture design.

show abstract

“…Additionally, Dharmapurikar et al adopted bloom filters (BFs), and Kim et al employed mask filters in the FPGA-based packet inspection [11,19]. However, these two methods only act as filters and have to cooperate with another string matching algorithm to verify a match.…”

Section: Other Approachesmentioning

confidence: 99%