Data stream exchanging and multiplexing system and method suitable for multi-stream regular expression matching

Abstract

The invention discloses a data stream exchanging and multiplexing system and a data stream exchanging and multiplexing method suitable for multi-stream regular expression matching. The system comprises a priority adding module, a programmable storage module, an information exchanging module, an exchange scheduling module and a single-stream REM (Recognition Memory) module, wherein the priority adding module is used for judging the characteristics of input data streams and endowing corresponding data stream priorities and data stream serial number information; the programmable storage module is connected with the information exchanging module, and is used for storing the data streams, the corresponding data stream priorities, the corresponding data stream serial numbers and data stream waiting time information; the information exchanging module is connected with the priority adding module, the programmable storage module and the exchange scheduling module respectively; the exchange scheduling module is connected with the information exchanging information, and is used for dynamically selecting data streams to be processed and adjusting the exchanging lengths of the data streams; and the single-stream REM module is connected with the information exchanging module, and is used for performing regular expression matching on data streams transmitted by using the information exchanging module. According to the system and the method, simultaneous processing of multiple data streams can be supported, and high flexibility and a high resource utilization ratio are achieved.

Description

technical field [0001] The invention relates to a data stream switching and multiplexing system and method suitable for multi-stream regular expression matching. Background technique [0002] Regular expression matching (REM) is an important part of the network intrusion detection system (NIDS), which mainly completes the in-depth detection of potential threats; with the continuous increase of network bandwidth and network traffic, the network content that REM needs to scan increases rapidly. The performance becomes the bottleneck of the network security system. [0003] The REM structure can be realized by constructing a non-deterministic finite automaton (NFA) in the FPGA, which can take advantage of the efficient parallel processing mechanism of the FPGA and a large number of programmable logic resources; in order to improve the rate of regular expression matching, achieve a higher system throughput, researchers in the past have proposed many technologies to optimize the...

AI Technical Summary

Problems solved by technology

[0004] Among several traditional methods of extending single-stream REM to multi-stream REM, the simplest method is to build an independent REM system for each data stream. This method is simple and easy to implement but has poor scalability. When the number of data streams Most of the time, it requires a lot of memory; another method is to apply a REM system to the processing of multiple streams through time-division multiplexing; this method has strong scalability and high resource utilization; based on time-division multiplexing There are two implementation methods of competition processing and weighted exchange; competition processing is a first-come-first-served processing method, and the data stream that arrives first is processed first, and the next data stream is selected after all the data streams are processed; this method When processing a data stream, it is necessary to temporarily store other data streams for subsequent processing, which will consume a large amount of cache resources. When the number of data streams is large, the system will be burdened and the implementation will be more complicated; the weighted exchange is for each The priority of the data flow is defined, and the data flow to be processed is selected according to the priority

Images