Issue No.02 - July-December (2008 vol.7)
Derek Pao , City University of Hong Kong, Hong KOng
Wei Lin , Tsinghua University, Beijing
Bin Liu , Tsinghua University, Beijing
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/L-CA.2008.5
We present a pipelined approach to hardware implementation of the Aho-Corasick (AC) algorithm for string matching called P-AC. By incorporating pipelined processing, the state graph is reduced to a character trie that only contains forward edges. Edge reduction in P-AC is very impressive and is guaranteed algorithmically. For a signature set with 4434 strings extracted from the Snort rule set, the memory cost of P-AC is only 21.5 bits/char. The simplicity of the pipeline control plus the availability of 2-port memories allow us to implement two pipelines sharing the set of lookup tables on the same device. By doing so, the system throughput can be doubled with little overhead. The throughput of our method is up to 8.8 Gbps when the system is implemented using 550MHz FPGA.
string matching, deterministic finite automaton, pipelined processing, network intrusion detection
Derek Pao, Wei Lin, Bin Liu, "Pipelined Architecture for Multi-String Matching", IEEE Computer Architecture Letters, vol.7, no. 2, pp. 33-36, July-December 2008, doi:10.1109/L-CA.2008.5