Implementation of reduced storage finite automata in field-programmable gate arrays.

摘要

Deep Packet Inspection (DPI) has been widely adopted in detecting network threats such as intrusion, viruses and spam. It is challenging, however, to achieve high speed DPI due to expanding rule sets and ever-increasing line rates. One key issue is that the size of the finite automata falls beyond the capacity of on-chip memory, thus incurring expensive off-chip memory accesses. This thesis presents a hardware-based DPI engine that utilizes novel techniques to minimize the storage requirements for finite automata. We propose a technique that uses a modified form of content addressable memory, interleaved memory banks, and data packing. The performance evaluation results show that up to 2.5 Gbps throughput can be reached using a single engine in a contemporary FPGA chip. In many cases, the single engine approach can yield over 90% reduction in the memory usage over a straightforward approach.