Hardware Implementation for Scalable Lookahead Regular Expression Detection

1. Hardware Implementation for Scalable LookaheadRegular Expression Detection Author : Masanori Bando, N. Sertac Artan and H. Jonathan Chao Publisher : Parallel & Distributed Processing, Workshops and Phd Forum (IPDPSW), 2010 Presenter : Jo-Ning Yu Date : 2011/05/11

2. Example LaFA Architecture Correlation Block Detection Block Evaluations Outline

3. Example

4. Detection Block : detect the simple strings and variable strings in the input string. • Correlation block: correlate detected Events(＊) to determine whether the input matches any of the RegExes in its RegEx set. • The match signal is called an Event in this paper. LaFA Architecture

5. LaFA Architecture Correlation Block n = 3

6. RegEx1 : abc[a-z]op S1 V1 S2 RegEx4 : abc[^x]{3}xyz S1 V2 S3 Timing History

7. Node Infomation

8. Correlation Block

9. Buffered Lookup Modules • The modules use previously detected character histories to verify a queried variable string. • Time Lookup Module (TLM) • Contents Lookup Module (CLM) • Frequently appearing Repetition detection Module (FRM) • Short simple string Detection Module (SDM) • In-line Lookup Module • The module processes incoming characters in real time. • Repetition Detection Module(RDM) Detection Modules

10. TLM detects character classes and negated character classes with no repetition, ex : [a-z], or [ˆ0-9]. TLM incorporates an input buffer, which stores characters recently received from a packet in chronological order. Ex: Time Lookup Module (TLM)

11. TLM Architecture

12. CLM detects negated single characters with repetitions, ex : [ˆa]{3}, [ˆa]{3,5}, or [ˆa]{3,}. CLM stores timestamps of every ASCII character. Thus, 256 memory locations are reserved, each for one ASCII character. Ex: Contents Lookup Module (CLM)

13. CLM Architecture C = 8

14. RDM detects character classes and negated character classes with repetitions, ex : [a-z]{3}, [a-z]{3,5}, and [a-z]{3,} ( base{min, max} ). The RDM is the only in-line detection module. Once number of repetitions reaches to the minimum repetition value, a next simple string is activated. The next simple string inactivate when number of repetitions reaches to the maximum repetition value. Ex: Repetition Detection Module (RDM)

15. RDM Architecture R = 2

16. The FRM can detect any type of repetition using a buffered lookup approach. FRM can be shared among multiple RegExes that helps to improve resource efficiency. When the sequence breaks, the count and timestamp are stored in a history memory inside of the FRM. Frequently Appearing Repetition Detection Module(FRM)

17. FRM Architecture F = 4

18. We classify strings with less than 5 charactersas a short simple string. It naturally generate more Events. The SDM architecture is very similar to the TLM except that in the SDM, there are multiple memory blocks to support multiple character lookups at a clock cycle. Short Simple String Detection Module (SDM)

19. SDM Architecture

20. SSD : Simple String Detector[11] Evaluations

21. Memory Requirements for the System Evaluations

22. The design is running at a clock frequency of 250MHz, which is equivalent to 2Gbps detection throughput per engine. Xilinx Virtex-6 FPGA contains 32Mbits of block RAM. Since 17 LaFA engine can fit in the FPGA, we expect the total throughput can reach to 34Gbps. Evaluations