Speculative Parallel Pattern Matching

Abstract

Abstract-Intrusion prevention systems (IPSs) determine whether incoming traffic matches a database of signatures, where each signature is a regular expression and represents an attack or a vulnerability. IPSs need to keep up with ever-increasing line speeds, which has lead to the use of custom hardware. A major bottleneck that IPSs face is that they scan incoming packets one byte at a time, which limits their throughput and latency. In this paper, we present a method to search for arbitrary regular expressions by scanning multiple bytes in parallel using speculation. We break the packet in several chunks, opportunistically scan them in parallel, and if the speculation is wrong, correct it later. We present algorithms that apply speculation in single-threaded software running on commodity processors as well as algorithms for parallel hardware. Experimental results show that speculation leads to improvements in latency and throughput in both cases.Index Terms-Low latency, multibyte, multibyte matching, parallel pattern matching, parallel regular expression matching, regular expressions, speculative pattern matching.

Decompression-free inspection: DPI for shared dictionary compression over HTTP

“…Since matches are in general infrequent [25], the regular expression engine is not executed often (on average, we have only 5 executions per file). Furthermore, even when all the anchors are matched, the engine will not have scan more than a few bytes.…”

Speculative parallel pattern matching using stride-k DFA for deep packet inspection

“…Another approach which focuses on improving throughput and reducing latency is SPPM (Luchaup et al, 2009(Luchaup et al, , 2011. This approach achieves significant speed-up by dividing the input stream into two chunks, and then scanning one byte each from both the chunks in parallel.…”

“…This approach achieves significant speed-up by dividing the input stream into two chunks, and then scanning one byte each from both the chunks in parallel. Different SPPM based algorithms for single-threaded software running on commodity processors as well as for parallel hardware are proposed in Luchaup et al (2009Luchaup et al ( , 2011.…”

“…Luchaup et al proposed a speculative parallel pattern matching (SPPM) approach to match regular expressions against network packets (Luchaup et al, 2011(Luchaup et al, , 2009). This approach allows splitting of an input string into two chunks, and processing one byte each from both the chunks in parallel.…”

“…In Luchaup et al (2011), authors have presented SPPM which makes use of stride-1 DFA (stride-1 SPPM) to match one byte each from the two chunks of input traffic. We propose that by increasing the stride level k, which would allow multiple bytes to be processed per chunk at a time, the processing efficiency is increased.…”