DPICO: A High Speed Deep Packet Inspection Engine Using Compact Finite Automata

Transcription

1 DPICO: A High Speed Deep Packet Inspection Engine Using Compact Finite Automata Chistophe L. Hayes and Yan Luo Depatment of Electical and Compute Engineeing Univesity of Massachusetts Lowell Lowell, MA, 8 USA hayesc@pi.edu, yan luo@uml.edu ABSTRACT Deep Packet Inspection (DPI) has been widely adopted in detecting netwok theats such as intusion, viuses and spam. It is challenging, howeve, to achieve high speed DPI due to the expanding ule sets and eve inceasing line ates. A key issue is that the size of the finite automata falls beyond the capacity of on-chip memoy thus incuing expensive off-chip accesses. In this pape we pesent DPICO, a hadwae based DPI engine that utilizes novel techniques to minimize the stoage equiements fo finite automata. The techniques poposed ae modified content addessable memoy (mcam), inteleaved memoy banks, and data packing. The expeiment esults show the scalable pefomance of DPICO can achieve up to 7.7 Gbps thoughput using a contempoay FPGA chip. Expeiment data also show that a DPICO based acceleato can impove the patten matching pefomance of a DPI seve by up to times. Categoies and Subject Desciptos C.. [Compute Communication Netwoks]: Geneal Secuity and Potection (e.g., Fiewalls); C.. [Compute Communication Netwoks]: Netwok Opeations Netwok monitoing Geneal Tems Algoithms, Design, Pefomance, Secuity Keywods Finite Automata, Content Addessable Memoy, FPGA, Intusion Detection Chistophe Hayes has since moved to Rensselae Polytechnic Institute. Pemission to make digital o had copies of all o pat of this wok fo pesonal o classoom use is ganted without fee povided that copies ae not made o distibuted fo pofit o commecial advantage and that copies bea this notice and the full citation on the fist page. To copy othewise, to epublish, to post on seves o to edistibute to lists, equies pio specific pemission and/o a fee. ANCS 7, Decembe, 7, Olando, Floida, USA. Copyight 7 ACM /7/ $... INTRODUCTION Compute netwoks ae becoming inceasingly vulneable to many theats, such as intusions, woms, viuses and spam. When these theats, which continuously incease in numbe and complexity, ae coupled with constantly inceasing netwok line ates, the situation becomes moe difficult to contain. Deep Packet Inspection (DPI) plays an impotant ole in detecting theats by seaching the payload of netwok packets fo known pattens o signatues [, ]. It is also essential in taffic chaacteization and fine-gained netwok monitoing. A DPI system pefoms a set of time-citical opeations to sense cetain netwok pattens o behavio while tying to minimize packet pocessing latency. The fist step is to captue packets fom netwok inteface cads, eassemble and buffe them fo pocessing. The second step is to seach known signatue pattens in the payload of packets. Following that, a DPI system will analyze the matched packets against semantic-ich policies to detemine if an attack is pesent o an alet should be tiggeed. We ague that the fist step can be sped up with Application Specific Integated Cicuits (ASICs) due to the invaiance of the task, and the policy pocessing is bette caied out with genealpupose pocessos because of the complex semantic pocessing. The matching of signatue pattens falls in the middle of the spectum, and can benefit fom pogammable hadwae acceleation based on FPGAs o netwok pocessos. The expanding signatue sets and inceasing line speed have made the signatue patten matching challenging. Fo example, the ule set of the well-known intusion detection system, Snot [9], contains 9 ules as of Dec, and new ules ae added constantly. Vaiable patten length and location, and inceasingly lage ule sets make patten matching a difficult task. Many sting matching algoithms exist, such as those due to Boye-Mooe [9], Wu-Manbe [], and Aho-Coasick []. As moe geneal cases of fixed stings, egula expessions used to depict patten signatues futhe complicate the task due to possible exponential numbe of states. Thee have been numeous studies on egula expession matching [,,, ]. Diffeent platfoms have been used to pefom DPI, including ASICs [], FPGAs [] and netwok pocessos [7]. Most of these methods ely on state machines o finite automata to match pattens. Howeve, one of the key issues is that the size of the finite automata is so lage (often at least tens of megabytes) that they have to be stoed in off-chip memoy modules. As a esult, the seaching on the automata incus a lage numbe of off-chip 9

2 memoy accesses that lead to unsatisfactoy pefomance. Thus it is impotant to minimize the stoage equiements of state machines such that they can be put into on-chip o othe fast memoy modules to achieve high-speed patten matching. We ae motivated to study efficient memoy utilization of pogammable hadwae achitectue to impove the pefomance of signatue patten matching. In this pape, we pesent DPICO, a hadwae based DPI engine that utilizes novel techniques to educe the stoage fo finite automata. We fist analyze the stoage of taditional Deteministic Finite Automata (DFA) and pesent the baseline design. Taking advantage of the multi-poted on-chip memoy banks on moden ASICs and FPGAs, we then use thee techniques to educe the edundant infomation: () modified content addessable memoy (mcam), () inteleaved memoy banks, and () data packing. The combination of these concepts allows data to be oganized in a moe efficient way. Ou analysis show that the stoage can be educed by ove 9%. We have implemented an FPGA based pototype incopoating the poposed techniques. The DPI pefomance of the system is shown to be scalable and each up to 7.7 Gbps using a contempoay FPGA chip. We evaluate the pefomance impact of incopoating a DPICO based acceleato in an x86/pcie seve achitectue. The data show that the patten matching pefomance of the DPI seve canbeimpovedbyuptotimes. The contibutions of ou wok ae as follows. We pesent effective techniques to stoe compact finite automata in FP- GAs, taking advantage of thei achitectual featues. Ou scalable design povides an empiical basis fo achitecting high pefomance DPI systems, whee the patten matching is an impotant pocessing phase. In addition, finite automata is necessay in uppe level semantic policy pocessing, thus ou appoach can be extended to speed up othe stateful packet inspection opeations. The pape is oganized as follows: Section eviews elated wok, Section descibes a motivating example and the baseline design, Section elaboates the poposed techniques to educe the stoage of DFA, and the pefomance esults ae pesented in Section. Finally, the pape is concluded in Section 6.. RELATED WORK Sting matching techniques such as Bloom Filtes [8] and Boye-Mooe [9], Wu-Manbe [], and Aho-Coasick [] algoithms have been the foundation fo many signatue-based detection engines ove many yeas. Some of these concepts have even been expanded to seach against egula expessions instead of fixed stings [, ]. Regula expessions incease the capability and maintainability of theat detection systems by inceasing the flexibility of theat definitions. Schaelicke et al. chaacteized the pefomance of the Snot softwae on geneal-pupose pocessos. They showed that thei highest pefomance test system could only simultaneously handle 7 payload ules on a netwok unning at a Mbps ate [8]. Moe ecently, Dege et al povided insights to the pefomance limitations of a Bo NIDS [] on a commodity PC and exploed ways to mitigate its esouce demands. Though extensive expeiments, they showed that Gbps netwok intusion detection ate cannot be achieved without caefully tuning the system. Clealy, the pefomance of netwok intusion detection implemented on geneal-pupose pocessos is deficient when consideing inceasing speed demands. Paxson et al poposed to ethink the hadwae suppot fo efficient netwok analysis and intusion pevention [6]. They descibed a high-level netwok secuity analysis pipeline, whee the potocol analysis is one of the stages. Patten matching against packet payload is indispensable to classify flows as inceasingly moe applications cannot be eliably identified by meely examining tanspot pot numbes. Many signatue-based systems have been achitected fo the FPGA [] and ASIC [], taking advantage of the paallel stuctues available in these devices. These designs ae pedominantly based on the Aho-Coasick algoithm o othe finite automaton-like stuctues. These achitectues have incementally impoved the speed o stoage utilization of signatue matching though modification of the implementation. These implementation-based impovements ae complemented by algoithmic impovements diected at modifying the finite automata themselves. Kuma et al. [] modified a DFA to combine common output tansitions of individual states by ceating a default tansition between those states. This modified DFA, known as the delayed-input deteministic finite automata o D FA is found to educe the DFA stoage of a patitioned Cisco ule set fom 9 MB to MB []. This significant savings begins to bing finite automaton pocessing of lage ule sets into a ange that is conceivable on an FPGA o netwok pocesso. This stoage impovement, howeve, is povided at the cost of the delayed input behavio, educing the aveage pocessing thoughput. Along with tansition eduction, state meging techniques have also been poposed [6]. Lin et al poposed to educe FPGA logics used to match egula expessions though shaing common sub-egula expessions []. Thei method is simila to a numbe of Nondeteministic Finite Automata (NFA) based appoaches [7], whose dawback is that those designs cannot easily accommodate new signatue pattens. A new compilation-synthesisplacement-download pocedue is needed because egula expessions ae hadcoded into FPGA logic elements. In this pape, we focus on memoy based finite automata because of its significant advantage ove logic based finite automata: the memoy based FA can be easily updated to incopoate new signatue pattens without epogamming FPGAs. Thee ae two popula categoies of finite automata: Nondeteministic Finite Automata (NFA) and Deteministic Finite Automata (DFA) []. They diffe significantly in the complexity of stoage and seaching. The space complexity of NFA is O(n) and its seaching complexity is O(n ), while DFA s seaching complexity is O() at the cost of space complexity O( n ). Fo DPI systems, DFA is the pefeed state machine especially fo delay sensitive netwok applications, thus it is the focus of this pape.. MOTIVATION AND BASELINE DESIGN. Motivating Example We assume that a specific netwok attack is pesent when the sting oot is found in the payload of a packet. Secondly, we assume a diffeent type of attack is being posecuted when the sting mdi is found in a packet. Each of these stings fom the foundation of a ule and togethe 96

3 d i m o t d i m o t d m o t i m o t d i d i t m d i m o t o d i m t o t d i m o d i m o t Figue : DFA fo the Regula Expession {oot mdi}. they make a ule set that can be used on evey packet to filte both types of attacks. Hee, we compile the ule set into a DFA that allows the ule stings to be found on at any point in the data steam, even when multiple stings ovelap. Figue shows a DFA fo the egula expession {oot mdi} with the input alphabet Σ = {d, i, m, o,, t}. The DFA contains nine states, two of which ae accepting states, and distinct tansitions. When accepting state five is eached, the sting mdi has been matched, and likewise, when accepting state eight is eached, the sting oot has been matched.. Baseline We use a taditional DFA implementation as a baseline fo pefomance compaison. In this method, the state machine is implemented in two memoy modules. One memoy module contains the state tansition table and the second module contains the match identifies. The cuent state pointe and the input chaacte ae combined and used as the addess to lookup the next state pointe. The cuent state pointe is also used as an addess to lookup the match identifie fo the cuent state. Input Cha Tansition Table (RAM) Cuent State Pt Output Table (RAM) Match ID Figue : Baseline State Machine Block Diagam When this method is used, each state is given a fixed and constant amount of memoy. This section of memoy contains a location fo each possible input chaacte. Fo instance, if the input chaacte wee eight bits wide, each state would equie enough memoy to contain 6 ( 8 ) next-state tansitions. When using this technique, the minimum amount of memoy (S) needed fo a finite automaton is deived fom the numbe of states in the automaton and the numbe of stings o egula expessions that can be matched. S = b N S lg(n S) + N S lg(n M +) whee b is the numbe of bits in the input chaacte, N S is the numbe of states in the automaton, and N M is the numbe of MatchIDs in the automaton. If the input to the state machine wee a -bit chaacte (to encode the alphabet in the motivating example), the baseline design would equie 7 locations in memoy; the poduct of the numbe of possible input chaactes by the numbe of states. Some of the infomation stoed, howeve, is edundant as thee ae only unique tansitions stoed in those 7 locations. It is though the elimination of this edundancy that we achieve inceased stoage efficiency.. PROPOSED TECHNIQUES In geneal, multiple egula expessions ae encoded into a single finite automaton. When an accepting state of the automaton is eached, a egula expession is matched. Each accepting state is given a Match ID to signify which egula expession has been matched. If the Match ID is all zeos, the cuent state is not an accepting state and hence thee is no egula expession match. In ou design, we assume that the state tansition table fo the finite automata will be stoed in a unifom cost RAM as shown in Fig.. Each state of a finite automaton consists of one o moe next-state tansitions. A tansition will equie exactly one location in memoy. States in the DFA can contain a vaiable numbe of next-state tansitions. Next-state tansitions fo any given state will be stoed contiguously in the memoy, and likewise, states themselves will be stoed contiguously. In such a design, we take advantage of thee techniques to allow fo the eduction of edundant infomation: () modified Content Addessable Memoy (mcam), () inteleaved memoy banks, and () data packing. The combination of these concepts allows data to be oganized in a moe efficient way.. Modified Content Addessable Memoy Fo a given DFA, the memoy in the baseline design will contain epeated data. Fo instance, a given state will have many tansitions that have the same next-state pointe. Since the baseline design explicitly stoes evey tansition, the epetition of data is inheent to the achitectue. To emove the pointe epetition, it is necessay to modify the next-state lookup technique. This is accomplished by ceating two types of tansitions: labeled tansitions and default tansitions. To tanslate an explicit state tansition table fo a DFA, whee evey possible tansition is stoed, to an implicit one, we take the most fequent next-state pointe fo a given state and make it the default tansition. All othe tansitions ae conveted into labeled tansitions. Each state can contain up to one labeled tansition fo each label and each state will contain exactly one default tansition. This default/labeled tansition technique can be applied to all the deteministic finite automata (DFA). Some DFA vaiants such as the delayed-input finite automaton (D FA []), have inheent default tansitions. These tansitions ae diffeent, howeve, because they cause the input to be 97

4 delayed when they ae taken. States that do not have delayed default tansitions can be given a non-delayed default tansition that can be selected in the same manne as the DFA. In this case, the delayed and non-delayed default tansitions need to be distinguished. Using these tansitions, we constuct a modified CAM stuctue (mcam) whee each state has its own associative memoy. Fig. depicts a set of states stoed in mcam. Labels fom the labeled tansitions ae the keys to the CAM and the next state pointe infomation is the data in the CAM. The default tansition and state infomation ae also stoed in the memoy and ae not accessed associatively. The size of states is non-unifom thus it has to be stoed within each state fo identifying the boundaies. The vaiable size of states makes the state access and tansition nontivial. Key n m Key Data Key Data CAM[m] Size Default Data [m] Key n Data n Key Data Key Data CAM[] Size Default Data [] Key n Data n Data n m Key Data Key Data CAM[] Size Default Data [] Figue : mcam Diagam All tansitions fo a state (default and labeled) ae ead fom the memoy. The labels ae compaed against the input chaacte. If the input chaacte matches one of the labels on a labeled tansition, its next-state pointe is taken, othewise, the next-state pointe fo the default tansition is taken. It is clea to see that this technique equies a lot of memoy accesses in ode to etieve the pointe fo the next state if a state contains a high numbe of unique next-state tansitions. Late, we will see that this issue can be addessed in the FPGA implementation such that the next-state pointe can be esolved in a single clock cycle. This mcam technique has both advantages and disadvantages. The numbe of locations equied fo the state is educed, howeve, the labeled tansitions equie stoage of the next state pointe along with the label. Secondly, the state no longe equies constant space in the memoy and can be packed moe tightly in memoy. This implies that the next state pointes would need to incease in size to account fo the fact that states do not occu on egula boundaies. Finally, the match identifie fo the state must be stoed. Since evey state contains exactly one default tansition, the match identifie is stoed with the default tansition. The minimum amount of memoy equied fo this method is based on the numbe of states, match identifies and labeled tansitions. In this case, the effective stoage savings fom staightfowad technique will be dictated by the atio,, of the aveage numbe of tansitions pe state fo the automaton to the total numbe of possible tansitions, b.as that atio deceases, the potential stoage savings inceases. The minimum memoy equied can be calculated as S eff = N S( lg(n M +) )+N T ( lg(n T ) + b) = NT b N S,N T N S whee N T is the numbe of tansitions in the automaton. Fom this, we evaluate the diffeences in minimum stoage equiements to see whee this method is most effective. The esults ae shown in Figue whee x axis is the numbe of states in the DFA and y axis is the pecentage of memoy eduction ((S S eff )/S). The poposed method is most effective when the finite automata with less aveage tansitions pe state. Also, any finite automaton with a atio above. does not benefit fom this method since the ovehead of stoing labels in the memoy outweighs the savings fom stoing less tansitions. Rule sets used in ecent eseach by Kuma et al. [] esult in tansition atios between. and.9 when these ule sets implemented as a DFA. Most of these ule sets also have tansition atios less than. when implemented as D FA. Thus the poposed modified CAM stuctue has potential to educe both the DFA and D FA stoage significantly. Pecent Impovement - - Ratio =.6 Ratio =. Ratio =. Ratio =.7 Ratio = Numbe of States Figue : Stoage Impovement with Vaied Tansition Ratios (b=8). Inteleaved Memoy Banks The CAM implementation will need to analyze all of the labeled tansitions and the default tansitions simultaneously in ode to evaluate a state in a single cycle. Cuent FPGA poducts geneally contain hundeds of individual memoy elements on-chip. Using these elements, we popose that the state tansition infomation be oganized into sequentially inteleaved memoy banks (shown in Fig.) to take advantage of the potential memoy bandwidth available in FPGA devices. If the numbe of banks, n, isgeate than o equal to the numbe of next-state tansitions fo the lagest state (N max), all the tansitions can be ead simultaneously and pocessed in paallel. This achitectue will allow each state to be pocessed within a single evaluation cycle. If the numbe of next-state tansitions exceeds n, a tansition will take a constant time of Nmax cycles, which n can be addessed though pipelined design. In fact, on-chip 98

5 6 and moe memoy banks have become common in moden FPGAs [], which guaantee one-cycle state evaluation and tansition. Calc Add ROM Calc Add ROM Calc Add ROM n- Phys. Add Bank Bank Bank Bank D Location Location Location Location Q RAM RAM RAM n- Location 8 Location Location 9 Location Location Location 6 Location Location 7 State Stat Offset Location Location Location Location Figue : Sequentially Inteleaved Memoy Banks (n=). Input Cha. Select Default Tansition Select Labeled Tansition (Mux) State End Offset Select Addess (Mux) Match ID On each ead cycle, n wods ae ead in paallel fom the inteleaved memoy. Any location in any bank can be the stat addess fo the n-wod ead. Fo example, a ead access can etieve wods, 6, 7 and 8, which span in two continuous ows. Since a state can have less than n tansitions, the size of the state must be encoded so that the ead logic can ignoe unnecessay infomation. Hee, we popose to inset the end offset of the state to the fist location of the state so that the faming can be detemined appopiately. Each location in the memoy eithe contains a default tansition o a labeled tansition. The location with a labeled tansition will contain the label and the next state pointe associated with the tansition. The location with a default tansition will contain the next state pointe fo the default tansition and necessay state infomation since thee is one default tansition pe state. The state infomation includes the offset of the last tansition fo the state and the match identifie fo the state. Since evey state has a default tansition, it is placed as the fist location fo the state. Figue 6 shows the stoage of labeled tansitions and default tansitions. The bit ange of each field is indicated in the figue. lg(n M )+lg(n T )+b- lg(n T )+b- MatchID Next State Pointe lg(n T )+b- Labeled Tansition b- Default Tansition Next State Pointe Label b- EndLocn Figue 6: Stoage of default tansition and labeled tansition. Using these concepts, we popose a geneal achitectue fo pefoming egula expession matching. Fig.7 depicts the block diagam of the DPI engine called DPICO. The achitectue consists of components fo addess calculation, tansition stoage, label compaison and detemining next state addess. The tansitions ae stoed in a sequentially inteleaved memoy as discussed peviously. Each memoy bank has an addess calculation unit to geneate pope bank addess based on the cuent state addess. The input chaacte is compaed against the labels of the cuent state state though a set of selection logic (bottom potion of Fig.7.) Figue 7: Block Diagam of DPICO.. Opeation of DPICO Since n is equal to o lage than the numbe of tansitions fo the state, all the tansitions ae ead simultaneously fom memoy banks though n-. The tansitions ae then pocessed to identify the pope next state using selection logic. The logic of selecting labeled tansition is shown in Fig. 8. All the tansitions ead fom the RAM ae qualified based on the beginning offset of the state and the end offset ead fom the default tansition. The memoy outputs outside of the ange ae simply ignoed, and only the qualified labeled tansitions ae compaed against the input chaacte. If a match exists, a multiplexe selects the output of the RAM that contains that label. If thee is no match the next state pointe fom the default tansition is used. On each ead cycle, the match identifie, which is also contained in the default tansition location, is output fom the state machine. The delay of addess calculation, memoy access and next state selection logic detemines the clock cycle time. Since the engine consumes one input chaacte pe clock cycle, the maximum pocessing thoughput of this appoach fo a DFA is simply the poduct of the input chaacte size and the pocessing clock fequency: T = b f max. Input Cha. State Stat Offset State End Offset Tansition Labels Compae Labels Qualify Labels Encode Next State Pt. Valid Next State Pointes Multiplexe Selected Next State Pointe Figue 8: Diagam of Selecting Labeled Tansition. Packing Acoss Memoy Boundaies In pactical application, the pevious solution does not equal the minimum memoy utilization descibed as S eff. Instead, the actual memoy size (S act) isdivenbythesize 99

6 Physical Bank Add Logical Add EndB: Pt: Label: Pt: MatchID: State 8 Add Labeled - Tans. Labeled Tans. Pt: Label: Labeled Tans. Labeled - State EndB: EndB: EndB: Pt: Label: t Pt: MatchID: Pt: Label: Pt: 9 Label: o Pt: MatchID: Pt: Label: Pt: MatchID: State 7 State 6 State Tans. Labeled Tans. Default Tansition Labeled Tans. Labeled - Tans. Labeled Tans. Default Tansition Labeled Tans. 7 State 9 8 EndB: EndB: Pt: Label: Pt: MatchID: Pt: Label: Pt: Label: i Pt: MatchID: Pt: Label: State State Labeled Tans. 6 Labeled - Tans. Labeled Tans. Labeled Tans. Labeled - Tans. Labeled Tans. Default Tansition State 7 Pt: 9 Label: d State 6 EndB: Pt: MatchID: Pt: Label: Figue : Example Packed Memoy Map EndB: EndB: Pt: 6 Pt: 6 Pt: MatchID: Pt: Label: o Label: m Label: Pt: MatchID: Figue 9: Memoy oganization fo {oot mdi}. of a memoy location, L, which is detemined by the size of the default tansition, S D, and the labeled tansition, S L. State State S act = L N T,L= max(s D,S L) Fig.9 shows the memoy oganization of the motivating example. It can be seen that some unused bits ae pesent in evey label tansition. The wasted memoy space (denoted as unused in Fig. 9) comes mainly fom the dispaity in the size of the default and labeled tansitions and the assumption that each tansition would occupy one location in memoy. The labeled tansitions tend to have less infomation and theefoe geneally smalle than default tansitions. One method to bette appoach the minimum memoy calculation is to pack the labeled tansitions acoss memoy location boundaies. Figue shows an example of the packing stategy fo a state machine with vaied numbes of tansitions pe state. The lage default tansition occupies a full memoy location and is always positioned on egula memoy location boundaies. Labeled tansitions ae packed between default tansitions. Some space may be unused fo a state. This unused space, howeve, tends to be smalle than the unused space fo an unpacked design. This packing does not incease the complexity and latency of selecting the next state because it only changes which bits ae fed to the compaison logic and all bits ae ead simultaneously anyway. The memoy bandwidth is saved effectively.. PERFORMANCE EVALUATION We evaluate ou DPICO engine in two aspects. Fist we study the effectiveness of the design and exploe the design space. Paticulaly we apply pipelining technique to optimize the design. Second, we investigate the pefomance Table : Compession Results Rule No. of Baseline DPICO DPICO Tans. Pct. Set Rules Size Unpacked Min. Ratio Savings (kbits) Size Size () (kbits) (kbits) imap 6 6, ftp 76, netbios 6, nntp 7, exploit,7. 7, impact of incopoating such a patten matching acceleato to a commodity seve achitectue since ou immediate goal is to speed up the patten matching phase of the DPI wokload with an acceleation cad. We then discuss the applicability of DPICO as on-chip acceleatos.. Pefomance Chaacteistics of DPICO We chaacteized the pefomance of the DPICO design in two ways - () by measuing the compession facto against a paticula DPI ule set and () by finding the speed and sizing chaacteistics of the design when implemented in an FPGA. This subsection summaizes those esults. To show compession esults, we begin with a subset of the Snot ule set. We choose five epesentative ule files, namely imap, ftp, netbios, nntp and exploit because thei size is elatively lage in the whole set. The ule files ae conveted into DFA and D FA, in the memoy table fomat of the baseline design. Next, these ulesets wee conveted into the table fomat of the DPICO design. The sizing esults ae found in Table which shows oveall DPICO can educe memoy usage by ove 9% fo all ule sets unde study. Data packing can educe about - % of the stoage. The DPICO has been witten in VHDL and tageted fo a Xilinx Vitex SX FPGA. The design was simulated using a VHDL simulato, synthesized with Synplicity Synplify and implemented using the Xilinx ISE tool chain. The baseline DFA design was found to opeate at a maximum of 67.7 MHz using almost no logic esouces including Look Up Table(LUT) and Registe(REG). Table shows the speed and sizing esults fom the stoage saving design

7 Table : Speed and Size of the DPICO No. of LUT REG f max T max Memoy (MHz) (Mbps) Banks Table : Speed and Size of Pipelined DPICO No. of Added LUT REG f max T max Non- Memoy Pipeline (MHz) (Mbps) pipelined Banks Stages T max (Mbps) when the data is unpacked and the automaton is a DFA. It is assumed that the numbe of paallel eads is geate than o equal to the maximum numbe of tansitions, both default and labeled, in any state. The thoughput given assumes 8-bit input chaactes ae used. The esults show that the clock fequency deceases as the numbe of banks incease. This is because the popagation delay of the logic encompassed in the Select Labeled Tansition Block and the Select Default Tansition Block must incease as the numbe of banks inceases. They contain multiplexes that must be sized appopiately to select data fom the appopiate numbe of banks. Lage multiplexes have longe popagation delays, subsequently deceasing the clock fequency at which the design can opeate. We then add pipeline stages to the DPICO design to minimize the popagation delay between clocked elements (egistes o block memoy), thus inceasing the maximum clock fequency. When pipeline stages ae added, the state machine can pocess multiple time-multiplexed steams of data. The numbe of time slots is equal to the numbe of pipeline stages, and the bandwidth of each individual data steam is the total bandwidth of the state machine divided by the numbe of clocked stages. The pipelined design pesents a tadeoff between maximum pocessing bandwidth fo the engine, which inceases when the numbe of pipeline stages inceases, vesus the pocessing bandwidth fo each steam, which deceases as the numbe of pipeline stages inceases. Table shows the esults fo vaied pipelined designs. Each ow of the table has diffeent numbe of memoy banks and pipeline stages. It can be seen that pipelined design bings significant impovement ove non-pipelined design. The educed clock fequency with moe memoy banks affect the oveall pefomance of pipelined designs: banks of memoy outpefom the othe configuations. DPICO engines can povide scalable pefomance by incopoating multiple engines on one FPGA chip to exploit packet level paallelism. We implement such a multi-engine design in which each engine handles a packet flow independently. Detailed pefomance esults ae shown in Table. The fist column is the numbe of memoy banks unde test including,, 8 and 6. The second column of the table shows the numbe of DPICO engines implemented on the chip, i.e. the numbe of packet flows that ae pocessed simultaneously. We also compae the non-pipelined design with the pipelined design. It can be obseved that multiple DPICO engines have little negative impact on the opeation fequency of each engine. The total thoughput of the patten matching pocessing is scalable to the numbe of engines on a chip. With a contempoay FPGA chip, the pefomance can each 7.7Gbps. Again, fou banks give the best oveall pefomance due to the complexity of compaison logics. The esults also imply the potential of DPICO on moe advanced FPGA chips.. Pefomance Impovement to a DPI Seve Achitectue Ou immediate goal is to incopoate DPICO acceleation cad into a commodity seve achitectue with x86 coes and PCI Expess buses. The DPICO engine sits in the FPGA on the PCIe acceleato and DFAs ae peloaded. A DPI system such as Snot and Bo uns on x86 coes, which send packet steams to the acceleato fo patten matching. The packet tansfe is ove the PCIe bus using DMA opeations. The DPICO engine seach the payload against DFAs and sends the esults of patten matching back to the x86 coes. We d like to study the potential of pefomance impovement of such a configuation. We set up the expeiment as follows. We use ealistic ules fom Snot ule set as the egula expessions to be matched. We captue packet taces at the netwok link connecting ou campus to the ISP. The packet tace file contains 6K TCP and UDP packets with nonzeo payload size. This ealistic tace file is used as the input packet steam to the DPI system. We ceate a compile to pase egula expessions and geneate coesponding DFAs. We un the egula expession matching wokload on a seve with Dual Intel Xeon pocessos (MB L cache) and GB memoy. We instument the wokload with gpof [] to ecod the time spent on the matching pocess (excluding the DFA ceation, bookkeeping, etc.) Then, we load the DFAs into DPICO engine and pocess the same packet tace on the acceleato cad. We compae pocessing time in the two scenaios, taking into account the ovehead such as passing packet payload ove the PCIe bus. In the expeiment, the packets ae tansfeed ove PICe bus in sequential ode, not being combined in batches to maximize the bandwidth utilization. Payload tansfe and the patten matching on FPGA ae not pipelined, which can be optimized late. These consevative settings imply the wost pefomance of DPICO based acceleato. We leave these optimizations fo futue wok. Fig. shows the esults of the expeiments. The y axis of the plot is the time spent on patten matching. The left two bas epesent the CPU pocessing time on the two Snot ule files, namely exploit.ules and web-cgi.ules. The pocessing time is the time spent on seaching the DFAs. The igh-most five bas depict the time used by the DPICO engines (in configuations of - and 8 engines) togethe with the ovehead. In fact the majoity of the ovehead is the payload tansfe ove PCIe bus (6x speed at 8GB/s). The delay of DPICO engines is deteministic as exactly one byte is consumed in one cycle, egadless of ule sets. This figue clealy shows that the pefomance impovement of a DPICO acceleato on an x86/pcie seve achitectue can eachuptotimes.

8 Table : Speed of DPICO with Multiple Engines Non-pipelined Pipelined No. of No. of f max T max Pipe- f max T max Memoy DPICO (MHz) (Mbps) line (MHz) (Mbps) Banks Engines Stages Time (ms),,8,6,,, 8 6 exploit web cgi DPICO() DPICO() DPICO() DPICO() DPICO Ovehead CPU Figue : Pefomance Impovement to x86/pcie Seve Achitectue DPICO(8). Discussions The DPICO design takes advantages of some featues of moden FPGA chips, but its applicability is not limited to FPGAs. WeaguethatDPICOcanbeintegatedasanonchip acceleato of a geneal pupose CPU, although it is not the focus of this pape. The contol logic of DPICO is simple thus does not demand significant silicon aea. On-chip DFA stoage can eliminate the ovehead of tansfeing payloads ove peipheal buses, howeve, on-chip memoy banks in geneal pupose CPUs ae expensive in aea and powe consumption. Coelations among memoy size, pefomance and powe is wothy studying. As patten matching ule sets expand, the limited on-chip memoy may get fully utilized thus equiing swapping unused DFAs to main memoy. So, it is also inteesting to investigate the tade-offs between a dedicated on-chip DFA memoy and a shaed DFA/cache memoy, and elated DFA eplacement policies. 6. CONCLUSION In this pape we pesent a high speed DPI engine, DPICO, which is shown to be most effective when the aveage tansition atio of a DFA is significantly less than.. The poposed techniques can educe the memoy usage of DFAs by 9%. Pefomance evaluation esults show that a pipelined implementations with multiple DPICO engines can each total a thoughput up to 7.7Gbps in contempoay FPGA devices. Expeiment data also show up to fold impovement on patten matching when incopoating an DPICO based acceleato to an x86/pcie seve achitectue unning DPI wokload. The high speed and scalability of DPICO make it a pomising candidate fo a wide ange of DPI applications such as netwok intusion detection and spam filteing.

9 Acknowledgment This wok is suppoted in pat by the National Science Foundation unde gant No. CNS 79 and a gant fom Intel Reseach Council. 7. REFERENCES [] Gnu gpof. Fee Softwae Foundation. [] TRE: POSIX Compliant Regula Expession Matching Libay. [] Vitex family oveview, Januay 7. Xilinx, Inc. [] A. V. Aho and M. J. Coasick. Efficient sting matching: an aid to bibliogaphic seach. Communications of the ACM, 8(6):, 97. [] F. Anjum, D. Subhadabandhu, and S. Saka. Signatue-based intusion detection fo wieless ad-hoc netwoks: A compaative study of vaious outing potocols. In IEEE Vehicula Technology Confeence, Octobe. [6] M. Becchi and S. Cadambi. Memoy-efficient egula expession seach using state meging. INFOCOM 7, pages pp. 6 7, May 7. [7] Joao Bispo, Ioannis Soudis, Joao M.P. Cadoso, and Stamatis Vassiliadis. Synthesis of egula expessions tageting fpgas: Cuent status and open issues. In Int. Wokshop on Applied Reconfiguable Computing (ARC 7), pages 79 9, Mangaatiba, Bazil, Mach 7. [8] B. H. Bloom. Space-time tade-offs in hash coding with allowable eos. Communications of the ACM, (7): 6, 97. [9] R. S. Boye and J. S. Mooe. A fast sting seaching algoithm. Communications of the ACM, ():76 77, 977. [] B.C. Bodie, R.K. Cyton, and D.E. Taylo. A Scalable Achitectue fo High-Thoughput Regula-Expession Patten Matching. In ISCA, Boston, MA, June 6. [] S. Dhamapuika and J. Lockwood. Fast and scalable patten matching fo netwok intusion detection systems. IEEE Jounal on Selected Aeas in Communications, ():78 79, Octobe 6. [] S. Kuma, S. Dhamapuika, P. Cowley, J. Tune, and F. Yu. Algoithms to acceleate multiple egula expession matching fo deep packet inspection. In SIGCOMM, Pisa, Italy, Septembe 6. [] Cheng-Hung Lin, Chih-Tsun Huang, Chang-Ping Jiang, and Shih-Chieh Chang. Optimization of egula expession patten matching cicuits on fpga. In DATE 6, Munich,Gemany,6. [] R.-T. Liu, N.-F. Huang, C.-H. Chen, and C.-N. Kao. A fast sting-matching algoithm fo netwok pocesso-based intusion detection systems. ACM Tansitions on Embedded Computing, xx():6 6,. [] V. Paxson. A system fo detecting netwok intudes in eal-time. Compute Netwoks, (-): 6 79, Decembe 999. [6] V. Paxson, K. Asanovic, S. Dhamapuika, J. Lockwood, R. Pang, R. Somme, and N. Weave. Rethinking hadwae suppot fo netwok analysis and intusion pevention. In Poc. USENIX Hot Secuity, August 6. [7] P. Piyachon and Y. Luo. Efficient memoy utilization on netwok pocessos fo deep packet inspection. In ACM Symposium on Achitectue fo Netwok and Communication Systems, San Jose, CA, Decembe 6. [8] L. Schaelicke, B. Mooe T. Slabach, and C. Feeland. Chaacteizing the pefomance of netwok intusion detection sensos. In Poceedings of the Sixth Intenational Symposium on Recent Advances in Intusion Detection (RAID ), LNCS, Spinge-Velag, Septembe. [9] Snot. [] L. Tan and T. Shewood. Achitectues fo Bit-Split Sting Scanning in Intusion Detection. IEEE Mico: Mico s Top Picks fom Compute Achitectue Confeences, Januay-Febuay 6. [] N. Weave, V. Paxson, and J. M. Gonzalez. The shunt: An fpga-based acceleato fo netwok intusion pevention. In Poceedings of the 7 ACM/SIGDA th intenational symposium on Field pogammable gate aays, Monteey, CA, 7. [] S. Wu and U. Manbe. Fast text seaching: Allowing eos. Communications of the ACM, ():8 9, 99. [] F. Yu, Z. Chen, Y. Diao, T. V. Lakshman, and R. H. Katz. Fast and memoy-efficient egula expession matching fo deep packet inspection. In ACM Symposium on Achitectue fo Netwok and Communication Systems, San Jose, CA, Decembe 6.