Range hash for regular expression pre-filtering

Abstract

Recently, major Internet carriers and vendors successfully tested high-speed backbone networks at 100-Gbps line speed to support rapid growth of the Internet traffic demands. In addition, traffic is getting more concentrated to points such as data centers, and demand for protecting such high-speed networks from attack traffic is increasing. Deep Packet Inspection (DPI) with Regular Expression (RegEx) detection is the de facto defense mechanism agains network intrusions. However, current RegEx detection systems cannot keep up with the upcoming high-speed line rate. The RegExes consist of three types of components, exact strings, character classes (CC), and repetitions. Exact string and repetition matching have been widely studied by RegEx research community for better performance. Yet, although more than 55% of RegExes in Snort signature set contain at least one CC, hardware based solutions that focus on CC detection is limited.In this paper we propose a new CC detection architecture called Range Hash that is suitable for high-speed, compact CC detection. Additionally, we propose a practical application of the Range Hash architecture where it can be used as a pre-filter for a Regular Expression detection system to increase overall RegEx detection performance. Based on our hardware prototype design which runs at 250MHz, Range Hash can reach to 100-Gbps CC detection throughput with today's FPGA chips.

Accelerating Regular-Expression Matching on FPGAs with High-Level Synthesis

“…Some designs focus on plaintext signatures which allow for the use of hash tables for match verification [22,23]. Taking a similar pipeline approach but targeting regex, Bando [24] tackles the issues of effectively filtering regex signatures with low specificity but does not detail a solution for verifying filtered packets once identified.…”

A Bloom Filter-Based Monitoring Station for a Lawful Interception Platform

“…Another approach for IDS implementation in FPGA is the Finite State Machine (FSM) paradigm [19,20], which has different pros and cons with the Bloom Filter approach [21]. Additionally, in [22], an FPGA implementation of a Deep Packet Inspection architecture with Regular Expression Detection is shown. In [23], a parallel pattern matching architecture based on a compact reconfigurable filter and a coprocessor for FPGA is presented.…”

Exploring and Enhancing the Performance of Parallel IDS on Multi-core Processors

“…Akamai, the biggest content provider handling around 20% of the total Internet traffic using 61,000 servers deployed worldwide, reports only less than 300 attacks in 24hours in average and so most of the traffic is legitimated. So, if we can filter out these benign packets and leave little suspicious packets for further precise verification, IDS with a throughput much less than the line rate can keep up with the traffic [10].…”