High-speed regular expression matching with pipelined automata

Matousek, Denis; Kořenek, Jan; Pus, Viktor

doi:10.1109/fpt.2016.7929431

“…Several works alleviate this disadvantage of NFAs by exploiting reconfigurability and fine-grained parallelism of FPGAs, allowing one to process one character per clock cycle (e.g. [3][4][5]15,16,19,20]).…”

Section: Related Workmentioning

confidence: 99%

Approximate reduction of finite automata for high-speed network intrusion detection

Češka

¹

,

Havlena

²

,

Holík

³

et al. 2019

Int J Softw Tools Technol Transfer

View full text Add to dashboard Cite

We consider the problem of approximate reduction of non-deterministic automata that appear in hardware-accelerated network intrusion detection systems (NIDSes). We define an error distance of a reduced automaton from the original one as the probability of packets being incorrectly classified by the reduced automaton (wrt the probabilistic distribution of packets in the network traffic). We use this notion to design an approximate reduction procedure that achieves a great size reduction (much beyond the state-of-the-art language preserving techniques) with a controlled and small error. We have implemented our approach and evaluated it on use cases from Snort, a popular NIDS. Our results provide experimental evidence that the method can be highly efficient in practice, allowing NIDSes to follow the rapid growth in the speed of networks.

show abstract

“…Becchi and Crowley [15] introduced a multi-striding technique, which is widely used to increase the throughput of many NFA-based RE matching architectures. Multi-striding alone, however, cannot increase the processing speed to 100 Gbps because with the length of the stride, the NFA grows rapidly, and the frequency drops dramatically [8].…”

Section: Related Workmentioning

confidence: 99%

“…They provide high computing power and flexibility for network traffic processing, and they are increasingly being used in data centers [6], [7] for this purpose. The flexibility of FPGAs allows them to match REs at speeds over 100 Gbps [8]. Such high speeds, however, put excessive demands on the resources of FPGAs.…”

Section: Introductionmentioning

confidence: 99%

Deep Packet Inspection in FPGAs via Approximate Nondeterministic Automata

Češka¹,

Havlena²,

Holík³

et al. 2019

Preprint

0

View full text Add to dashboard Cite

Deep packet inspection via regular expression (RE) matching is a crucial task of network intrusion detection systems (IDSes), which secure Internet connection against attacks and suspicious network traffic. Monitoring high-speed computer networks (100 Gbps and faster) in a single-box solution demands that the RE matching, traditionally based on finite automata (FAs), is accelerated in hardware. In this paper, we describe a novel FPGA architecture for RE matching that is able to process network traffic beyond 100 Gbps. The key idea is to reduce the required FPGA resources by leveraging approximate nondeterministic FAs (NFAs). The NFAs are compiled into a multi-stage architecture starting with the least precise stage with a high throughput and ending with the most precise stage with a low throughput. To obtain the reduced NFAs, we propose new approximate reduction techniques that take into account the profile of the network traffic. Our experiments showed that using our approach, we were able to perform matching of large sets of REs from SNORT, a popular IDS, on unprecedented network speeds.

show abstract

“…Related Work. Hardware acceleration for regex matching at the line rate is an intensively studied technology that uses general-purpose hardware [6][7][8][9][10][11][12][13][14] as well as FPGAs [3][4][5][15][16][17][18][19][20]. Most of the works focus on DFA implementation and optimization techniques.…”

Section: Introductionmentioning

confidence: 99%

“…Several works alleviate this disadvantage of NFAs by exploiting reconfigurability and fine-grained parallelism of FPGAs, allowing one to process one character per clock cycle (e.g. [3][4][5]15,16,19,20]).…”

Section: Introductionmentioning

confidence: 99%

Approximate Reduction of Finite Automata for High-Speed Network Intrusion Detection

Češka

¹

,

Havlena

²

,

Holík

³

et al. 2018

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

We consider the problem of approximate reduction of non-deterministic automata that appear in hardware-accelerated network intrusion detection systems (NIDSes). We define an error distance of a reduced automaton from the original one as the probability of packets being incorrectly classified by the reduced automaton (wrt the probabilistic distribution of packets in the network traffic). We use this notion to design an approximate reduction procedure that achieves a great size reduction (much beyond the state-of-the-art language preserving techniques) with a controlled and small error. We have implemented our approach and evaluated it on use cases from Snort, a popular NIDS. Our results provide experimental evidence that the method can be highly efficient in practice, allowing NIDSes to follow the rapid growth in the speed of networks.

show abstract

High-speed regular expression matching with pipelined automata

Cited by 9 publications

References 19 publications

Approximate reduction of finite automata for high-speed network intrusion detection

Approximate reduction of finite automata for high-speed network intrusion detection

Deep Packet Inspection in FPGAs via Approximate Nondeterministic Automata

Approximate Reduction of Finite Automata for High-Speed Network Intrusion Detection

Contact Info

Product

Resources

About