Fast and Scalable Pattern Matching for Content Filtering Sarang Dharmapurikar John Lockwood

Sarang Dharmapurikar Motivation ●Deep packet inspection  Detection of Internet worms, computer viruses, SPAM, copyrighted material, Intrusion Detection/Prevention  Layer-7 switching  Content classification ●Needs fast string matching mechanism ●Some desirable features of the mechanism  String matching at line speed  Ability to detect strings at random locations in the payload  Ability to detect 1000s of strings  Ability to handle arbitrarily long strings

Sarang Dharmapurikar Aho-Corasick Algorithm ●Two Problems  At least 1 memory access per character (at the most 2) oSlows it down  Only one character at a time obottleneck s3 : tel s5 : phone s6 : elephant s4 : telephone s1 : technical s2 : technically l e p h a n q24 q25 q26 q27 q28 q29 q30 t q31 e l e p h o n e q12 q13 q14 q15 q16 q17 q18 q0 q1 t e c h n i q2 q3 q4 q5 q6 c a l q7 q8 q9 q11 y q10 l p h o n e q19 q20 q21 q22 q23

Sarang Dharmapurikar Why not use multiple engines? Engine 1 Engine 2 Engine 3 Engine 4 Incoming connections Each engine needs plenty of memory…. On-chip memory not practical We need a memory chip Multiple memory chips More pins, more power, more cost

Sarang Dharmapurikar Can we… ●Process Multiple characters at a time ●Without using multiple memory chips ? ●What if we have a small amount of on-chip memory?

Sarang Dharmapurikar Our Approach ●Modify Aho-Corasick to jump ahead by k characters  Jump Ahead Aho-CorasicK (JACK)-FA ●Represent JACK-FA as a hash table. Keep only one copy in the off-chip memory ●Keep k copies of the compressed & approximate JACK-FA hash table in on-chip memory  Use Bloom filters for approximate representation  Consumes very little memory Off-chip JACK-FA Data stream On-chip approximate JACK-FAs

Sarang Dharmapurikar JACK-FA s3 : tel s5 : phon e s6 : elep hant s4 : tele phon e s1 : tech nica l s2 : tech nica lly s3 : tel s5 : phone s6 : elephant s4 : telephone s1 : technical s2 : technically q0q0 q1q1 q5q5 tech nica s3, q 2 q6q6 tele phon q3q3 hant q4q4 S 6 q 7 elep s3s3 tel S 4, s 5 e s5s5 e s1s1 l lly S 1, s 2

Sarang Dharmapurikar String matching with JACK-FA technxyzicallyabc hant q0q0 q3q3 q4q4 q1q1 q2q2 q5q5 q6q6 S 6 q 7 tech nica tele phon elep s3s3 s1s1 S 4, s 5 s5s5 tel l llye e S 1, s 2 w

Sarang Dharmapurikar String matching with JACK-FA technxyzicallyabc hant q0q0 q3q3 q4q4 q1q1 q2q2 q5q5 q6q6 S 6 q 7 tech nica tele phon elep s3s3 s1s1 S 4, s 5 s5s5 tel l llye e S 1, s 2 w

Sarang Dharmapurikar String matching with JACK-FA technxyzicallyabc hant q0q0 q3q3 q4q4 q1q1 q2q2 q5q5 q6q6 S 6 q 7 tech nica tele phon elep s3s3 s1s1 S 4, s 5 s5s5 tel l llye e S 1, s 2 w

Sarang Dharmapurikar String matching with JACK-FA technxyzicallyabc hant q0q0 q3q3 q4q4 q1q1 q2q2 q5q5 q6q6 S 6 q 7 tech nica tele phon elep s3s3 s1s1 S 4, s 5 s5s5 tel l lly e e S 1, s 2 w

Sarang Dharmapurikar String matching with JACK-FA technxyzicallyabc hant q0q0 q3q3 q4q4 q1q1 q2q2 q5q5 q6q6 S 6 q 7 tech nica tele phon elep s3s3 s1s1 S 4, s 5 s5s5 tel l lly e e S 1, s 2 w

Sarang Dharmapurikar String matching with JACK-FA technxyzicallyabc hant q0q0 q3q3 q4q4 q1q1 q2q2 q5q5 q6q6 S 6 q 7 tech nica tele phon elep s3s3 s1s1 S 4, s 5 s5s5 tel l lly e e S 1, s 2 w

Sarang Dharmapurikar Why we need k JACK-FA technxyzicallyabc hant q0q0 q3q3 q4q4 q1q1 q2q2 q5q5 q6q6 S 6 q 7 tech nica tele phon elep s3s3 s1s1 S 4, s 5 s5s5 tel l lly e e S 1, s 2

Sarang Dharmapurikar Speed up technxyzicallyab

Sarang Dharmapurikar Speed up technxyzicallyab A single machine in off-chip memory k approximte and compressed machines in on-chip memory Use Bloom filters

Sarang Dharmapurikar Tabular Representation hant q0q0 q3q3 q4q4 q1q1 q2q2 q5q5 q6q6 S 6 q 7 tech nica tele phon elep s3s3 s1s1 S 4, s 5 s5s5 tel l llye e S 1, s 2 [state, substr]Next StateMatching strFailure Chain [q 0, tech]q1q1 -q0q0 [q 0, tele]q2q2 S3S3 q0q0 [q 0, phon]q3q3 -q0q0 [q 0, elep]q4q4 -q0q0 [q 1, nica]q5q5 -q0q0 [q 2, phon]q6q6 -q 3, q 0 [q 4, hant]q7q7 S6S6 q0q0 [q 0, tel]-S3S3 -[q 3, e]-S5S5 - [q 5, lly]-S 1, S 2 - [q 5, l]-S1S1 -[q 6, e]- S 4, S 5 -

Sarang Dharmapurikar Implementation with Bloom Filters [state, substr]Next StateMatching strFailure Chain [q 0, tech]q1q1 -q0q0 [q 0, tele]q2q2 S3S3 q0q0 [q 0, phon]q3q3 -q0q0 [q 0, elep]q4q4 -q0q0 [q 1, nica]q5q5 -q0q0 [q 2, phon]q3q3 -q 3, q 0 [q 4, hant]q7q7 S6S6 q0q0 [q 0, tel]- S3S3 - [q 3, e]- S5S5 - [q 5, lly]- S 1, S 2 - [q 5, l]- S1S1 - [q 6, e]- S 4, S 5 - B4B3B1B2 q

Sarang Dharmapurikar Implementation with Bloom Filters [state, substr]Next StateMatching strFailure Chain [q 0, tech]q1q1 -q0q0 [q 0, tele]q2q2 S3S3 q0q0 [q 0, phon]q3q3 -q0q0 [q 0, elep]q4q4 -q0q0 [q 1, nica]q5q5 -q0q0 [q 2, phon]q3q3 -q 3, q 0 [q 4, hant]q7q7 S6S6 q0q0 [q 0, tel]- S3S3 - [q 3, e]- S5S5 - [q 5, lly]- S 1, S 2 - [q 5, l]- S1S1 - [q 6, e]- S 4, S 5 - B4B3B1B2 q1q1 B4B3B1B2 q2q2 B4B3B1B2 q3q3 B4B3B1B2 q4q4

Sarang Dharmapurikar Throughput with Snort strings ●Off-chip memory: 250 MHz QDR-SRAM, 64-bit wide ●String concentration: 1 in 100 characters ●2250 strings ●2 to 122 character strings

Sarang Dharmapurikar Conclusions ●Fast string matching is an important module for Content filtering applications ●Off-chip memory accesses slow down string matching ●A large fraction of memory accesses can be avoided  Using a small on-chip memory and Bloom filters ●Our accelerated Aho-Corasick algorithm  can process 2250 strings  with less than 50KB on-chip memory  At a speed of more than 10Gbps

Thanks! Questions ?

Sarang Dharmapurikar Motivation ●The multi-pattern matching algorithm works for short strings (16 bytes)  Hash computation over long strings becomes problematic  Some virus signatures can be several hundred bytes long  Snort’s longest string is 122 bytes

Sarang Dharmapurikar

Accelerated Aho-Corasick Algorithm ●How to support arbitrarily large strings? At the cost of more memory?  Break a long string into multiple smaller pieces  Stitch them in a state machine  Match individual segment and track the state machine q0q0 q1q1 q2q2 q3q3 tech nically Symbols Tail

Sarang Dharmapurikar Speed up technxyzicallyab s1s1 s2s2 s3s3 s4s4

Sarang Dharmapurikar Multiple machines technxyzicallyab s1s1 s2s2 s3s3 s4s4

Sarang Dharmapurikar Multiple machines technxyzicallyab s1s1 s2s2 s3s3 s4s4

Sarang Dharmapurikar Multiple machines technxyzicallyab s1s1 s2s2 s3s3 s4s4

Sarang Dharmapurikar Multiple machines technxyzicallyab s1s1 s2s2 s3s3 s4s4

Sarang Dharmapurikar Multiple machines technxyzicallyab s1s1 s2s2 s3s3 s4s4

Sarang Dharmapurikar Aho-Corasick Algorithm ●Two Problems  At least 1 memory access per character (at the most 2) oSlows it down  Only one character at a time obottleneck s3 : tel s5 : phone s6 : elephant s4 : telephone s1 : technical s2 : technically q0 l e p h a n q24 q25 q26 q27 q28 q29 q30 t q31 q1 p e t e l c h n i e p h o n e q2 q3 q4 q5 q6 q12 q13 q14 q15 q16 q17 q18 c a l q7 q8 q9 q11 y q10 l h o n e q19 q20 q21 q22 q23

Sarang Dharmapurikar Bloom Filter X m-bit Array H1H1 H2H2 H3H3 H4H4 HkHk Bloom Filter

Sarang Dharmapurikar Bloom Filter Y m-bit Array H1H1 H2H2 H3H3 H4H4 HkHk

Sarang Dharmapurikar Bloom Filter X m-bit Array match H1H1 H2H2 H3H3 H4H4 HkHk

Sarang Dharmapurikar Bloom Filter W m-bit Array Match (false positive) H1H1 H2H2 H3H3 H4H4 HkHk

Sarang Dharmapurikar Speed up technxyzicallyab

Sarang Dharmapurikar Speed up technxyzicallyab

Sarang Dharmapurikar Bloom filter Bloom Filter Is x present in the filter? {No, Yes} Can be a false positive But false positive probability is very small…like Represents a set of strings Each string consumes very few bits…like 12 to 16 bits