High Performance String Matching Algorithm for a Network Intrusion Prevention Systems (NIPS) Author： Yaron Weinsberg ,Shimrit Tzur-David ,Danny Dolev and Tal Anker Publisher： High Performance Switching and Routing , 2006 Presenter： Tsung-Lin Hsieh Date： 2011/09/28

Outline Introduction RTCAM algorithm Experimental Results

Introduction The pattern-matching algorithm must be able to operate at wire speed. With networking speeds doubling every year, it is becoming increasingly difficult for software-based solutions to keep up with the line rates. This paper presents a novel pattern matching algorithm, called RTCAM (Rotating TCAM), which suggests the usage of an off-the-shelf TCAM and some additional logic that can be implemented in HW.

Example of snort’s rules within- the maximum number of bytes allowed between two successive pattern matches. offset - indicates from where in the packet the pattern should be searched. distance - the minimum number of bytes allowed between two successive matches. depth - how far into the packet the algorithm should search for the specified pattern.

RTCAM Algorithm Populating the TCAM : two phases Phase I: Split Patterns into w size chunks. Phase II: Create shifted sub-patterns for each prefix by shifting prefix to right and adding don’t care bits. * * : Thus the name Rotating TCAM

RTCAM Algorithm Populating the TCAM w = 4

RTCAM Algorithm Procedure: Construct key of size w bytes at a position pos in packet payload with initial pos = 0. Perform TCAM Lookup. If associated shift value is not equal to zero then repeat first step after shift specified. If zero, then match occurs. Use associated data structures to access possible pattern. Build sub-patterns iteratively and use TCAM for lookup. A complete match only occurs when all sub-patterns match with shift of zero. Repeat first step with a shift of one.

RTCAM Algorithm Patterns List : TCAM_Ptrs used when pattern’s length is greater than w

RTCAM Algorithm TCAM Rules Table (TRT) : correlate a TCAM row and the patterns list.

RTCAM Algorithm Matched Pattern List : Rules List :

RTCAM Algorithm Example : Input Packet =“WWABCDEFTXYZABCDARP“ Matched Against

RTCAM Algorithm “WWABCDEFTXYZABCDAR”

Experimental Results Fully implemented a software version of an RTCAM-NIPS device written in Java and have tested our simulation with two complex pattern sets. ClamAV [17] – Ver 0.82 ,26987 simple patterns Snort [3] The input for our NIPS was comprised of a real packet trace from the MIT DARPA project [18]

Experimental Results ClamAV rule set : Snort rule set :

Experimental Results Scanning Time Results :

Experimental Results Scanning Time Results :

Experimental Results For a TCAM width of 24 : Since the RTCAM algorithm accesses the SRAM every TCAM lookup ,the scan ratio is 2[12] Average shift value is 7.4 SRAM access speed is 5 times of TCAM access speed So ,throughput = (2*7.4) / (1+0.2) = 12.35Gbps (60%)