Equipment and method for parallel mode matching

Abstract

The invention provides equipment and a method for parallel mode matching. The equipment comprises a conversion device and a matching device, wherein the conversion device is used for combining a plurality of modes into a mode group and connecting the ith character of each mode in the mode group to form the ith character vector, wherein i is equal to 1, 2, 3 to N, and N is the character number contained in the mode having most characters in the mode group; and the matching device is used for respectively comparing each character in the ith character vector with the ith character in the data stream from the first character vector to carry out parallel mode matching. The invention has the advantages that the utilization ratio of a processor is greatly increased by using SIMD commands, the cost for memory access is lower, the size of codes is reduced by using fewer commands, and the branch delay is minimized.

Description

technical field [0001] The present invention relates to a device and method for parallel pattern matching, and more particularly, relates to a device and method for parallel pattern matching using a vector method. Background technique [0002] DPI (Deep Packet Inspection) technology (more specifically for network intrusion detection), as an important method in network monitoring and analysis technology (such as NIDS), has high requirements for computing and communication capabilities of computers. Typically, DPI is required to match very large network traffic with large pattern groups, the performance required is proportional to the traffic speed of the network interface being monitored, and both of these make DPI useful for searching on gigabit speed traffic Large schema groups become difficult to implement. [0003] Traditional pattern matching systems are based on byte-by-byte comparisons, which do not take advantage of the SIMD (Single Instruction Multiple Data) instruc...

AI Technical Summary

Problems solved by technology

However in figure 2 In the case shown, there are unpredictable branch instructions that are the main cause of cache mismatches and pipeline faults

Especially for deeply pipelined processors, these cache mismatches and pipeline faults greatly degrade performance

[0005] On the other hand, although a parallel pattern matching mechanism is produced, these pattern matches are unanchored matches, which leads to a large increase in the number of memory accesses, so that executing an instruction consumes more clock cycles

Also, if the pattern to match is less than 16 bytes, it doesn't adequately balance SIMD's resources

Images