Hardware Implementation for Scalable Lookahead Regular Expression Detection

Author : Masanori Bando, N. Sertac Artan and H. Author : Masanori Bando, N. Sertac Artan and H. Jonathan ChaoJonathan Chao

Publisher : Parallel & Distributed Processing, Publisher : Parallel & Distributed Processing, Workshops and Phd Forum (IPDPSW), 2010Workshops and Phd Forum (IPDPSW), 2010

Presenter : Jo-Ning YuPresenter : Jo-Ning YuDate : 2011/05/11Date : 2011/05/11

Example

LaFA Architecture

Correlation Block

Detection Block

Evaluations

2

Outline

Example

3

Detection Block : detect the simple strings and variable strings in the input string.

Correlation block : correlate detected Events(＊ ) to determine whether the input matches any of the RegExes in its RegEx set.

＊ The match signal is called an Event in this paper.

LaFA Architecture

4

5

LaFA Architecture

Correlation Block

n = 3

RegEx1 :

abc[a-z]op S1 V1 S2

RegEx4 : abc[^x]{3}xyz

S1 V2 S3

Timing History

6

Node Infomation

7

Correlation Block

8

Buffered Lookup Modules The modules use previously detected character

histories to verify a queried variable string. Time Lookup Module (TLM) Contents Lookup Module (CLM) Frequently appearing Repetition detection Module (FRM) Short simple string Detection Module (SDM)

In-line Lookup Module The module processes incoming characters in real time.

Repetition Detection Module(RDM)

Detection Modules

9

TLM detects character classes and negated character classes with

no repetition, ex : [a-z], or [ˆ0-9].

TLM incorporates an input buffer, which stores characters recently received from a packet in chronological order.

Ex:

Time Lookup Module (TLM)

10

TLM Architecture

11

CLM detects negated single characters with

repetitions, ex : [ˆa]{3}, [ˆa]{3,5}, or [ˆa]{3,}.

CLM stores timestamps of every ASCII character. Thus, 256 memory locations are reserved, each for one ASCII character.

Ex:

Contents Lookup Module (CLM)

12

13

CLM ArchitectureC = 8

RDM detects character classes and negated character

classes with repetitions, ex : [a-z]{3}, [a-z]{3,5}, and [a-z]{3,} ( base{min, max} ).

The RDM is the only in-line detection module.

Once number of repetitions reaches to the minimum repetition value, a next simple string is activated. The next simple string inactivate when number of repetitions reaches to the maximum repetition value.

Ex:

Repetition Detection Module (RDM)

14

15

RDM Architecture

R = 2

The FRM can detect any type of repetition using a

buffered lookup approach.

FRM can be shared among multiple RegExes that helps to improve resource efficiency.

When the sequence breaks, the count and timestamp are stored in a history memory inside of the FRM.

Frequently Appearing Repetition Detection Module(FRM)

16

17

FRM Architecture

F = 4

We classify strings with less than 5 characters

as a short simple string.

It naturally generate more Events.

The SDM architecture is very similar to the TLM except that in the SDM, there are multiple memory blocks to support multiple character lookups at a clock cycle.

Short Simple String Detection Module (SDM)

18

19

SDM Architecture

＊ SSD : Simple String Detector[11]

Evaluations

20

Memory Requirements for the System

21

Evaluations

The design is running at a clock frequency of

250MHz, which is equivalent to 2Gbps detection throughput per engine.

Xilinx Virtex-6 FPGA contains 32Mbits of block RAM. Since 17 LaFA engine can fit in the FPGA, we expect the total throughput can reach to 34Gbps.

22

Evaluations