Highly memory-efficient LogLog hash for deep packet inspection

Masanori Bando, N. Sertac Artan, H. Jonathan Chao

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Today's network line rates reach speeds of 40 Gbps and are anticipated to reach 100 Gbps in the near future. These high speeds make Deep Packet Inspection (DPI) in Network Intrusion Detection and Prevention Systems (NIDPSs) very challenging. The DPI examines each incoming packet byte-by- byte and matches them against a set of predefined malicious signatures. One way to achieve high-speed DPI is to store all the signatures on high-speed on-chip memory. However, on-chip memory is limited and space-efficient data structures are needed to leverage precious on-chip memory efficiently. A hash table addressed by a Minimal Perfect Hash Function (MPHF) is such a high-speed, space efficient data structure. In this paper, we describe a highly memory-efficient MPHF, which requires 3.5 bits per key to facilitate access to the key in on-chip memory while allowing us to perform the expensive exact match operation only once. The proposed MPHF also has a low construction time.

Original languageEnglish (US)
Title of host publication2008 IEEE Global Telecommunications Conference, GLOBECOM 2008
Pages2029-2034
Number of pages6
DOIs
StatePublished - 2008
Event2008 IEEE Global Telecommunications Conference, GLOBECOM 2008 - New Orleans, LA, United States
Duration: Nov 30 2008Dec 4 2008

Publication series

NameGLOBECOM - IEEE Global Telecommunications Conference

Other

Other2008 IEEE Global Telecommunications Conference, GLOBECOM 2008
CountryUnited States
CityNew Orleans, LA
Period11/30/0812/4/08

ASJC Scopus subject areas

  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'Highly memory-efficient LogLog hash for deep packet inspection'. Together they form a unique fingerprint.

  • Cite this

    Bando, M., Artan, N. S., & Chao, H. J. (2008). Highly memory-efficient LogLog hash for deep packet inspection. In 2008 IEEE Global Telecommunications Conference, GLOBECOM 2008 (pp. 2029-2034). [4698166] (GLOBECOM - IEEE Global Telecommunications Conference). https://doi.org/10.1109/GLOCOM.2008.ECP.391