Author : Masanori Bando, N. Sertac Artan and H. Jonathan Chao Publisher : Parallel & Distributed Processing, Workshops and Phd Forum (IPDPSW), 2010 Presenter : Jo-Ning Yu Date : 2011/05/11

  Example  LaFA Architecture  Correlation Block  Detection Block  Evaluations 2 Outline

 Example 3

  Detection Block : detect the simple strings and variable strings in the input string.  Correlation block : correlate detected Events ( ＊ ) to determine whether the input matches any of the RegExes in its RegEx set. ＊ The match signal is called an Event in this paper. LaFA Architecture 4

 5 Correlation Block n = 3

  RegEx1 : abc[a-z]op S 1 V 1 S 2  RegEx4 : abc[^x]{3}xyz S 1 V 2 S 3 Timing History 6

 Node Infomation 7

 Correlation Block 8

  Buffered Lookup Modules  The modules use previously detected character histories to verify a queried variable string.  T ime L ookup M odule (TLM)  C ontents L ookup M odule (CLM)  F requently appearing R epetition detection M odule (FRM)  S hort simple string D etection M odule (SDM)  In-line Lookup Module  The module processes incoming characters in real time.  R epetition D etection M odule(RDM) Detection Modules 9

  TLM detects character classes and negated character classes with no repetition, ex : [a-z], or [ˆ0-9].  TLM incorporates an input buffer, which stores characters recently received from a packet in chronological order.  Ex: Time Lookup Module (TLM) 10

 TLM Architecture 11

  CLM detects negated single characters with repetitions, ex : [ˆa]{3}, [ˆa]{3,5}, or [ˆa]{3,}.  CLM stores timestamps of every ASCII character. Thus, 256 memory locations are reserved, each for one ASCII character.  Ex: Contents Lookup Module (CLM) 12

 13 CLM Architecture C = 8

  RDM detects character classes and negated character classes with repetitions, ex : [a-z]{3}, [a-z]{3,5}, and [a-z]{3,} ( base{min, max} ).  The RDM is the only in-line detection module.  Once number of repetitions reaches to the minimum repetition value, a next simple string is activated. The next simple string inactivate when number of repetitions reaches to the maximum repetition value.  Ex: Repetition Detection Module (RDM) 14

 15 RDM Architecture R = 2

  The FRM can detect any type of repetition using a buffered lookup approach.  FRM can be shared among multiple RegExes that helps to improve resource efficiency.  When the sequence breaks, the count and timestamp are stored in a history memory inside of the FRM. Frequently Appearing Repetition Detection Module (FRM) 16

 17 FRM Architecture F = 4

  We classify strings with less than 5 characters as a short simple string.  It naturally generate more Events.  The SDM architecture is very similar to the TLM except that in the SDM, there are multiple memory blocks to support multiple character lookups at a clock cycle. Short Simple String Detection Module (SDM) 18

 19 SDM Architecture

 ＊ SSD : Simple String Detector[11] Evaluations 20

  Memory Requirements for the System 21 Evaluations

  The design is running at a clock frequency of 250MHz, which is equivalent to 2Gbps detection throughput per engine.  Xilinx Virtex-6 FPGA contains 32Mbits of block RAM. Since 17 LaFA engine can fit in the FPGA, we expect the total throughput can reach to 34Gbps. 22 Evaluations