Transactional Memory Automaton Engine for Packet Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network processors face inefficiencies in handling packet traffic and virus detection, particularly in parsing HTTP requests to identify and block malicious files, due to limitations in automaton hardware engines and indexing methods.
Innovation Solution
The implementation of a novel automaton hardware engine with a transition table organized into 2n rows, encoding two NFAs, and a pipeline with a controller, along with a remote processor interacting with transactional memory and byte-wise comparison circuits to analyze byte streams, enables efficient processing and detection of patterns in packet traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single transition table is used to encode multiple NFAs, then device complexity is reduced, but manufacturing precision deteriorates due to difficulty in organizing all rows to be usable for storing entry values that point to other rows
Solution Approach 1:
The transition table is segmented into 2n rows where n is the number of states per NFA, allowing multiple NFAs to be encoded independently while maintaining systematic organization. Each NFA can utilize the full table through different indexing schemes, resolving the conflict between complexity reduction and organization precision.
Solution Approach 2:
The transition table is designed to serve multiple NFAs simultaneously through dual indexing schemes. The same physical table structure supports multiple logical NFAs by allowing different entry points and interpretation methods, making the table universal for multiple purposes while maintaining precise control over row utilization.
2Ease of operation
If traditional indexing methods are used for NFAs, then ease of operation is maintained, but productivity deteriorates due to inability to efficiently process multiple NFAs in parallel
Solution Approach 1:
The indexing system is made dynamic by allowing the same transition table to be indexed differently for different NFAs. The system can adaptively select which NFA to execute and how to index into the table based on runtime requirements, enabling efficient parallel processing of multiple NFAs while maintaining ease of operation through unified table access.
Solution Approach 2:
By organizing the transition table with 2n rows and dual indexing schemes, the system ensures continuous useful action across multiple NFAs. All rows remain usable for storing entry values that point to other rows, eliminating wasted table space and enabling uninterrupted parallel processing of multiple network traffic patterns.
3Measurement precision
If byte stream is read out of transactional memory during NFA processing, then measurement precision improves for intermediate analysis, but loss of time increases due to repeated memory access
Solution Approach 1:
The byte stream is preliminarily loaded into the transactional memory buffer before NFA processing begins. The NFA engine then processes the entire stream continuously without intermediate read operations, performing all pattern matching and analysis in a single pass. This preliminary positioning of data eliminates repeated memory access while maintaining analysis precision through the engine's internal processing capabilities.
Solution Approach 2:
The transactional memory buffer serves as an intermediary between the byte stream source and the NFA engine. It holds the complete byte stream in an accessible format, allowing the engine to perform precise measurements and analysis without direct repeated access to the original data source, thereby reducing time loss while maintaining measurement precision.
Data Source
AI summary
A remote processor interacts with a transactional memory that has a memory, local BWC (Byte-Wise Compare) resources, and local NFA (Non-deterministic Finite Automaton) engine resources. The processor causes a byte stream to be transferred into the transactional memory and into the memory. The processor then uses the BWC circuit to find a character signature in the byte stream. The processor obtains information about the character signature from the BWC circuit, and based on the information uses the NFA engine to process the byte stream starting at a byte position determined based at least in part on the results of the BWC circuit. From the time the byte stream is initially written into the transactional memory until the time the NFA engine completes, the byte stream is not read out of the transactional memory.