《Architecture for Network Security》.pdf

A Memory Efficient Multiple Pattern Matching Architecture for Network Security Tian Song, Wei Zhang Dongsheng Wang, Yibo Xue Dept. of Computer Science and Technology Microprocessor and SoC Tech. RD Center Tsinghua University Tsinghua University Beijing, P.R.China Beijing, P.R.China {songt02, zhwei02}@ {wds, yiboxue}@ Abstract—Pattern matching is one of the most important As one of the basic operations, multiple pattern matching components for the content inspection based applications of is the performance bottleneck of many content inspection or network security, and it requires well designed algorithms and deep packet inspection based applications. Pattern matching architectures to keep up with the increasing network speed. architectures for network intrusion detection systems have For most of the solutions, AC and its derivative algorithms are emerged in the past few years, which can handle thousands widely used. They are based on the DFA model but utilize large amount of memory because of so many transition rules. An of patterns. A clear trend is that pattern sets of applications algorithm, called ACC, is presented in this paper for multiple become larger and larger. For example, tens of thousands of pattern matching. It uses a novel model, namely cached signatures are already common in anti-virus scanners.