A Fast Scalable Automaton-Matching Accelerator for

Embedded Content Processors

KUO-KUN TSENG, YUAN-CHENG LAI, YING-DAR LIN, and TSERN-HUEI LEE

ACM Transactions on Embedded Computing Systems, April 2009.

Also appeared in AINAW 2007, SYSARC 2007.

FSAM

● Fast scalable automaton-matching● Bitmap-AC (INFOCOM 2004) based DPI● Goal: Faster matching speed with space tradeoff● Two techniques:

– Root-Index matching: for root state– Pre-hash matching: for non-root states

3

Aho-Corasick

Forward Transitions (To Deeper states)Failure Transitions

Given a states s,

Depth(s): Depth(S4) = 2, Depth(S13) = 3

Label(s): Label(S4) = BD, Label(S13) = BCA

Label(S12) = CDBCAB

Failure Transitions to S0 are omitted

4

Lookup Table format used in:

(# of Forward transitions) more than 64.

State Structure (1/3)Lookup Table Format

5

State Structure(2/3)Linear Format

S4 (S0)

S5 (S7) D S6

S2 (S0) C S5 D S4 E S3

6

State Structure (3/3)Bitmap Format

S5 (S7)

S2 (S0)

00010 S6

00111 S5 S4 S3

FSAM Algorithm

Three Components:1. Root-Index Matching2. PreHash Matching3. AC Matching (Bitmap-AC Matching)

PreHash (Overview)

PreHash (Idea)

● Using for non-root states.● Quickly test multiple suffixes of the current state to

avoid slow Bitmap AC matching (bitmap testing).● Per-state vectors to keep the valid suffix information.● Failure Transitions are included in valid suffix

consideration.● Testing result:

– Miss: Return to root state– Hit: do Bitmap-AC matching

PreHash (Example)

Root-Index (Idea)

● Using for root state (S0) only● Goal: Process multiple characters● Issue: Memory explosion

– 256*256*256 …● Solution: RFC-like (SIGCOMM 1999) data structure

Root-Index (Example)

Architecture (FPGA-based)

Parameter

● URL Patterns (SquidGuard)– 194,096 states– BitmapAC (SizeAC 6.85 MB)– Kroot = 4 (Sizeroot 7.5 MB)– Kprehash = 2 (Sizeprehash 3.23 MB)

● Virus Patterns (ClamAV)– 402,173 states– BitmapAC (SizeAC 14.19 MB)– Kroot = 2 (Sizeroot 0.25 MB)– Kprehash = 2 (Sizeprehash 4.97 MB)