Range hash for regular expression pre-filtering

Masanori Bando, N. Sertac Artan, Rihua Wei, Xiangyi Guo, H. Jonathan Chao

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Recently, major Internet carriers and vendors successfully tested high-speed backbone networks at 100-Gbps line speed to support rapid growth of the Internet traffic demands. In addition, traffic is getting more concentrated to points such as data centers, and demand for protecting such high-speed networks from attack traffic is increasing. Deep Packet Inspection (DPI) with Regular Expression (RegEx) detection is the de facto defense mechanism agains network intrusions. However, current RegEx detection systems cannot keep up with the upcoming high-speed line rate. The RegExes consist of three types of components, exact strings, character classes (CC), and repetitions. Exact string and repetition matching have been widely studied by RegEx research community for better performance. Yet, although more than 55% of RegExes in Snort signature set contain at least one CC, hardware based solutions that focus on CC detection is limited. In this paper we propose a new CC detection architecture called Range Hash that is suitable for high-speed, compact CC detection. Additionally, we propose a practical application of the Range Hash architecture where it can be used as a pre-filter for a Regular Expression detection system to increase overall RegEx detection performance. Based on our hardware prototype design which runs at 250MHz, Range Hash can reach to 100-Gbps CC detection throughput with today's FPGA chips.

Original languageEnglish (US)
Title of host publicationANCS 2010 - Proceedings of the 6th ACM/IEEE Symposium on Architectures for Networking and Communications Systems
PublisherIEEE Computer Society
ISBN (Print)9781450303798
DOIs
StatePublished - 2010

Publication series

NameANCS 2010 - Proceedings of the 6th ACM/IEEE Symposium on Architectures for Networking and Communications Systems

Keywords

  • Pre-Filter
  • Range
  • Range matching
  • Regular expressions

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Hardware and Architecture
  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'Range hash for regular expression pre-filtering'. Together they form a unique fingerprint.

  • Cite this

    Bando, M., Artan, N. S., Wei, R., Guo, X., & Chao, H. J. (2010). Range hash for regular expression pre-filtering. In ANCS 2010 - Proceedings of the 6th ACM/IEEE Symposium on Architectures for Networking and Communications Systems [5623834] (ANCS 2010 - Proceedings of the 6th ACM/IEEE Symposium on Architectures for Networking and Communications Systems). IEEE Computer Society. https://doi.org/10.1145/1872007.1872032