Pattern Matching Using Ternary Content-Addressable Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional Network Intrusion Prevention Systems (NIPS) face a trade-off between detection accuracy and efficiency, struggling to maintain line-rate performance as networking speeds increase, due to the limitations of software-based pattern-matching solutions.
Innovation Solution
The implementation of a pattern-matching apparatus utilizing a ternary content-addressable memory (TCAM) that stores pattern segments and generates keys to efficiently match patterns in data communications networks, enabling line-rate speed while maintaining detection accuracy, and is compatible with Snort's rules syntax.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If software-based pattern-matching solutions are used, then detection accuracy can be maintained, but processing speed deteriorates and cannot keep up with line rates
Solution Approach 1:
The pattern-matching problem is segmented by dividing patterns into smaller substrings of length W that can be stored in the TCAM. The incoming data stream is also segmented into overlapping windows of the same length. This segmentation allows the system to process multiple patterns simultaneously in parallel hardware rather than sequentially in software, achieving both high speed and accuracy.
Solution Approach 2:
The patent replaces software-based pattern matching with hardware-based TCAM (Ternary Content-Addressable Memory) processing. TCAM provides parallel comparison capabilities that operate at line rate speeds, substituting the sequential mechanical processing of software with parallel hardware operations. This substitution maintains detection accuracy while achieving the required processing speed.
2Reliability
If software-based pattern-matching solutions are used, then detection functionality can be implemented, but productivity deteriorates as networking speeds increase
Solution Approach 1:
The patent introduces an intermediary layer between the incoming data stream and the detection logic. The TCAM acts as an intermediary that pre-processes and compares data segments against stored pattern substrings, generating match signals that are then processed by the detection logic. This intermediary hardware layer enables line-rate performance while maintaining reliable detection functionality.
3Speed
If TCAM is used for pattern matching, then processing speed improves to line-rate, but memory requirements and system complexity increase
Solution Approach 1:
Instead of storing complete patterns in the TCAM, the system segments patterns into smaller substrings of length W. This segmentation reduces the memory requirements of the TCAM while maintaining detection capability, as the segmented substrings can be recombined and compared against overlapping windows of the incoming data stream.
Solution Approach 2:
The TCAM stores only partial pattern information (substrings of length W) rather than complete patterns. This partial storage approach reduces memory complexity while the system compensates by processing overlapping windows of the data stream, ensuring complete pattern detection despite the reduced TCAM content.
Data Source
AI summary
An apparatus having a content-addressable memory (CAM) that stores a plurality of entries comprising portions of a plurality of patterns; a memory that stores a shift value corresponding to each of the entries; and a controller that generates a first key based on a received string, applies the first key to the CAM to select an entry of the CAM, retrieves the shift value from the memory corresponding to the selected entry, in response to the shift value being equal to a predetermined value, identifies an initial match, and in response to the initial match corresponding to a first pattern of the plurality of patterns that is larger than the entries of the CAM, applies adjacent keys based on the received string to the CAM, and declares a complete match when each of the corresponding shift values from the memory is equal to the predetermined value.