1. High-Performance Pattern Matching for Intrusion Detection
IEEE Infocom 2006

2. Contents Background: AC algorithm BFSM Optimizations to BFSM
The implementation of BFSM
Experimental Results

3. The AC Algorithm
P={he, she, his, hers}

4. The AC Algorithm
P={he, she, his, hers}

5. The AC Algorithm
P={he, she, his, hers}

6. The AC Algorithm
The Non-deterministic Finite Automaton (NFA)

7. The AC Algorithm
Convert NFA to DFA (deterministic FA)

8. The AC Algorithm The Standard AC State Node Implementation:
struct ac_node {
int * next_state[256];
rule * match_rule_list; }

9. The BFSM Algorithm Concentrate on DFA
Mainly a novel implementation of DFA
The work is based on implementation on hardware, FPGA or ASIC.

10. The BFSM Algorithm The transition rules The description of BFSM
*Rule Selection Policy
*State Clusters for scalability purpose

11. The BFSM Algorithm
The transition rules

12. The BFSM Algorithm
The block diagram of BFSM

13. The BFSM Algorithm
Rule Selector Policy: Balanced Routing Table Searching Algorithm

14. The BFSM Algorithm Balanced Routing Table Searching Algorithm:
** The maximum number of collisions for every hash index is no more than a configurable bound P.
The index bits:
** optimally selected by an update function

15. The BFSM Algorithm
State Clusters: Improve the Scalability

16. The BFSM Algorithm
Optimizations to BFSM: Don’t-care rules

17. The BFSM Algorithm
State Encoding & Index Calculation

18. The Implementation of BFSM
Transition-rule Generation
Distributed BFSM Approach
Dynamic Incremental Updates
Case Sensitivity and Regular Expression

19. The Implementation of BFSM
Introduction: Three examples
Example1: P={“pattern”}

20. The Implementation of BFSM
Introduction: Three examples
Example1: P={“pattern”}

21. The Implementation of BFSM
Introduction: Three examples
Example2: P={“tesing”, ”pattern”}

22. The Implementation of BFSM
Example2: P={“tesing”, ”pattern”}

23. The Implementation of BFSM
Example3: P={“tesing”, ”testcase”}

24. The Implementation of BFSM
Example3: P={“tesing”, ”testcase”}

25. The Implementation of BFSM
Transition-Rule Generation

26. The Implementation of BFSM
Transition-Rule Generation

27. The Implementation of BFSM
Transition-Rule Generation

28. The Implementation of BFSM
Transition-Rule Generation

29. The Implementation of BFSM
Transition-Rule Generation

30. The Implementation of BFSM
Transition-Rule Generation
P={“tesing”, ”testcase”}

31. The Implementation of BFSM
Distributed BFSM Approach

32. The Implementation of BFSM
Distributed BFSM Approach
** Improved performance
** Increased storage efficiency
** Increased flexibility

33. The Implementation of BFSM
Distributed BFSM Approach

34. The Implementation of BFSM
Case Sensitivity & Regular Expression
Case Sensitivity:
** Process Separately

35. The Implementation of BFSM
Regular Expressions
P={“abd|D”, ab*c}

36. The Implementation of BFSM
Dynamic Incremental Updates
** creating copies of the modified transition-rule tables
** creating the entire updated B-FSM and switching while reach state S0

37. The Pattern Matching Engine

38. Performance

39. Performance

40. Performance

41. Performance Virtex-4 with 1MB of block RAM 2K patterns 2~10 Gbps
ASIC: at least 20Gbps

42. Discussion!