Context-Aware Pattern Matching Accelerator for Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing hardware accelerators for network security face limitations in handling complex rule syntaxes and large rule databases, leading to performance vulnerabilities and reduced accuracy in context-aware pattern matching and text parsing, especially with the increasing sophistication of cyber attacks and network bandwidth.
Innovation Solution
A context-aware packet pattern matching system that employs a hardware acceleration device with a pre-matching module to identify candidate packets and a full-match process to determine if they satisfy access control rules, using special purpose instructions and contextual information to improve accuracy and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If existing hardware accelerators are used for pattern matching, then processing speed is improved, but accuracy in context-aware pattern matching deteriorates due to limitations in handling complex rule syntaxes and large rule databases
Solution Approach 1:
The hardware accelerator is divided into multiple processing stages including a pre-matching stage that performs initial filtering using simplified rules, and a full-matching stage that performs detailed context-aware pattern matching. This segmentation allows the system to achieve high processing speed through parallel pre-matching while maintaining accuracy through sequential full-matching verification.
2Measurement precision
If complex rule databases are implemented to improve pattern matching accuracy, then matching precision is improved, but device complexity increases leading to performance vulnerabilities
Solution Approach 1:
The pre-matching stage performs preliminary filtering of packets against a subset of critical rules before full pattern matching is applied. This preliminary action reduces the number of packets that require complex full-matching processing, thereby maintaining high accuracy for critical patterns while reducing overall device complexity and avoiding performance vulnerabilities.
3Measurement precision
If full pattern matching is applied to all packets, then matching accuracy is improved, but processing time increases reducing productivity
Solution Approach 1:
The system applies full pattern matching selectively to packets that pass the pre-matching stage, rather than to all packets. This partial action approach ensures high matching accuracy for packets that require detailed analysis while maintaining high processing throughput by using faster pre-matching for the majority of packets that can be filtered earlier.
Data Source
AI summary
Methods and systems for improving accuracy, speed, and efficiency of context-aware pattern matching are provided. According to one embodiment, a packet stream is received by a first stage of a hardware accelerator of a network device. A pre-matching process is performed by the first stage to identify a candidate packet that matches a string or over-flow pattern associated with access control (e.g., IPS or ADC) rules. A candidate rule is identified based on a correlation of results of the pre-matching process. The candidate packet is tokened to produce matching tokens and corresponding locations. A full-match process is performed on the candidate packet by a second stage of the hardware accelerator to determine whether it satisfies the candidate rule by performing one or more of (i) context-aware pattern matching, (ii) context-aware string matching and (iii) regular expression matching based on contextual information, the matching tokens and the corresponding locations.