Abstract
Aho-Corasick algorithm has been widely used in network intrusion detection system to inspect network packets against thousands of attack patterns. To improve the performance of network intrusion detection systems, many variations of Aho-Corasick algorithm are proposed to accelerate multiple string matching on GPUs or dedicated hardware. One of the proposed variations is to increase the number of characters that are processed per cycle. However, increasing the number of characters processed per cycle will encounter two major problems. The first problem is the input alignment problem while the second problem is the large increase of memory required for storing the state transition table. The two problems cause the multi-character approach become less feasible. In this paper, we propose a novel parallel dual-character string matching algorithm on graphical processing units. In order to solve the two major problems, the proposed algorithm presents a new state machine to solve the input alignment problem, and compresses the state transition table using perfect hashing to solve the memory explosion problem. The experimental results show that the proposed algorithm is superior to the state-of-the-art approaches in terms of performance and memory requirements.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
AbuHmed, T., Mohaisen, A., Nyang, D.: A survey on deep packet inspection for intrusion detection systems. CoRR abs/0803.0037 (2008)
Aho, A.V., Corasick, M.J.: Efficient string matching: An aid to bibliographic search. Commun. ACM 18(6), 333–340 (1975)
Alicherry, M., Muthuprasanna, M., Kumar, V.: High speed pattern matching for network ids/ips. In: Proceedings of the 2006 IEEE International Conference on Network Protocols, pp. 187–196 (2006)
Bremler-Barr, A., Hay, D., Koral, Y.: CompactDFA: Generic state machine compression for scalable pattern matching. In: 2010 Proceedings of IEEE INFOCOM, pp. 1–9 (2010)
Chang, Y.K., Chang, C.R., Su, C.C.: The cost effective pre-processing based nfa pattern matching architecture for nids. In: 2010 24th IEEE International Conference on Advanced Information Networking and Applications, pp. 385–391 (2010)
Chen, C.C., Wang, S.D.: An efficient multicharacter transition string-matching engine based on the aho-corasick algorithm. ACM Trans. Archit. Code Optim. 10(4), 25:1–25:2 (2013)
Clang: A C language family frontend for LLVM. https://clang.llvm.org/ (April 2017)
Dharmapurikar, S., Lockwood, J.W.: Fast and scalable pattern matching for network intrusion detection systems. IEEE J. Select. Areas Commun. 24(10), 1781–1792 (2006)
Dharmapurikar, S., Lockwood, J.: Fast and scalable pattern matching for content filtering. In: Proceedings of the 2005 ACM Symposium on Architecture for Networking and Communications Systems ANCS 2005, NY, USA. pp. 183–192. ACM, New York (2005)
Hua, N., Song, H., Lakshman, T.V.: Variable-stride multi-pattern matching for scalable deep packet inspection. IEEE INFOCOM 2009, 415–423 (2009)
Jiang, W., Yang, Y.H.E., Prasanna, V.K.: Scalable multi-pipeline architecture for high performance multi-pattern string matching. In: 2010 IEEE International Symposium on Parallel Distributed Processing (IPDPS), pp. 1–12 (2010)
Kim, J., i. Choi, S.: High speed pattern matching for deep packet inspection. In: 2009 9th International Symposium on Communications and Information Technology, pp. 1310–1315 (2009)
Lin, C.H., Li, J.C., Liu, C.H., Chang, S.C.: Perfect hashing based parallel algorithms for multiple string matching on graphic processing units. IEEE Trans. Parallel Distrib. Syst. 99, 1 (2017)
Lin, C.H., Liu, C.H., Chien, L.S., Chang, S.C.: Accelerating pattern matching using a novel parallel algorithm on gpus. IEEE Trans. Comput. 62(10), 1906–1916 (2013)
NVIDIA: CUDA Zone (2016). https://developer.nvidia.com/cuda-zone
OpenCL - The open standard for parallel programming of heterogeneous systems (2017). https://www.khronos.org/opencl/
The OpenMP API specification for parallel programming (2016). http://www.openmp.org/
Wikipedia: Data structure alignment (2017). https://en.wikipedia.org/wiki/Data_structure_alignment
Yamagaki, N., Sidhu, R., Kamiya, S.: High-speed regular expression matching engine using multi-character nfa. In: 2008 International Conference on Field Programmable Logic and Applications, pp. 131–136 (2008)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2017 Springer International Publishing AG
About this paper
Cite this paper
Liao, CY., Lin, CH. (2017). A Novel Parallel Dual-Character String Matching Algorithm on Graphical Processing Units. In: Ibrahim, S., Choo, KK., Yan, Z., Pedrycz, W. (eds) Algorithms and Architectures for Parallel Processing. ICA3PP 2017. Lecture Notes in Computer Science(), vol 10393. Springer, Cham. https://doi.org/10.1007/978-3-319-65482-9_13
Download citation
DOI: https://doi.org/10.1007/978-3-319-65482-9_13
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-65481-2
Online ISBN: 978-3-319-65482-9
eBook Packages: Computer ScienceComputer Science (R0)