Range Hash for Regular Expression Pre-Filtering Publisher : ANCS’ 10 Author : Masanori Bando, N. Sertac Artan, Rihua Wei, Xiangyi Guo and H. Jonathan Chao Presenter : Yu-Hsiang Wang Date : 2010/12/15 1

Outline Introduction CC-detection Problem P-tag Construction Architecture Memory Requirements 2

Introduction Pre-filter that can efficiently filter out legitimate traffic before the traffic reaches to the slower RegEx detection system can increase the overall DPI throughput without losing reliability of the DPI. 3

Introduction The RegExes consist of three basic components: Exact strings(e.g., abcd), character classes (CC) (e.g., [a-z]), and Repetitions (e.g.,{2,5}, ∗, +). This paper is to introduce a high-speed, and resource- efficient CC detector called Range Hash for RegEx pre- filtering. 4

CC-detection Problem Comparison of exact matching and range matching. A na¨ıve solution to perform this type of range matching is to introduce an additional stage, we call a Tag Table (Encoder). 5

CC-detection Problem The tag table should report all possible combinations (nine tag combinations in this example). This number increases matching operation complexity of the next stage by introducing more queries to the Hash Table. In addition, the complexity increases exponentially with number of overlapped ranges. 6

Prefix Tag By using the tag and the length, P-Tag can specify any range. In other words, one tag can represent multiple ranges and we can distinguish between these ranges by using different lengths for the same tag. 7

Prefix Tag The length table is constructed based on the existing RegEx signatures, so the table is called Signature Based Length Table (SBLT). 8

P-tag Construction Pattern and Range Extraction -In this example, the pattern length is 4 characters. Replace the uncertain repetition by the repetition we can guarantee. 9

P-tag Construction Practical RegEx sets have various overlapping ranges and some of these overlapping ranges do not naturally fit into the binary tree. Add virtual ranges and virtual nodes. 10

P-tag Construction 11

Architecture This entire Range Hash architecture with i number of detection path as one Range Hash track. Most of the RegEx sets require less than 16 detection paths. 12

Architecture Length “0” is assigned to the exact characters. -ASCII code of “a” is stored in the Result Table, and the final check module verify if the first character is a character “a”. 13

Architecture Implement these tags in separate detection modules called Tracks 14

Memory Requirements 15

Memory Requirements 16

FPGA ( Xilinx Virtex-4 FX100 ) The prototype design can reach 250-MHz operation speed, which is equivalent to 4-Gbps (=250-Mbps × 8- bits × 2Memory Ports). Thus, for 100-Gbps operation, 25 Range Hash engines are required, which will have a total memory of 12Mbit (25 engines× 496 kbits) for a pre-filter the BackDoor rules, which holds largest number of patterns. 17