Sept. 10, 2007 to Sept. 14, 2007
Jia Ni , Tsinghua University, Beijing, China
Chuang Lin , Tsinghua University, Beijing, China
Zhen Chen , Tsinghua University, Beijing, China
Peter Ungsunan , Tsinghua University, Beijing, China
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/ICPP.2007.7
Deep Packet Inspection (DPI) is a critical function in network security applications such as Firewalls and Intrusion Detection Systems (IDS). Signature based scanners used in DPI apply multi-pattern matching algorithms to check whether the packet payload or flow content contains a specified signature in a signature set. Existing multi-pattern matching algorithms sacrifice memory space to achieve better performance. In this paper a novel fast multi-pattern matching algorithm, the Hash Boyer-Moore (HBM) Algorithm, is presented, which reduces the memory footprint of the heuristic table using a hash function and adds another heuristic table to reduce the false-positive ratio. Analyses and simulations show HBM offers higher speed and lower memory cost than some existing algorithms. The HBM algorithm was implemented on the Intel IXP 2400 Network Processor (NP) platform and experiments show suitable performance results in a Gigabit Ethernet LAN environment.
Jia Ni, Chuang Lin, Zhen Chen, Peter Ungsunan, "A Fast Multi-pattern Matching Algorithm for Deep Packet Inspection on a Network Processor", ICPP, 2007, 2013 42nd International Conference on Parallel Processing, 2013 42nd International Conference on Parallel Processing 2007, pp. 16, doi:10.1109/ICPP.2007.7