A Multipattern Matching Algorithm Using Sampling and Bit Index Author: Jinhui Chen, Zhongfu Ye, Min Tang Publisher: Computer Systems and Applications, AICCSA IEEE/ACS International Conference on Presenter: Yu-Ping Chiang Date: 2008/10/01

Outline Basic SBI  Preprocessing Stage  Sampling and Matching Stage  Performance Analysis Variant SBI  For Multiple Pattern  For Bit Pattern Matching  For Less Memory Experimental Result (Avg. Runtime)  Single Pattern  Multiple Pattern  Bit Pattern  Different n and m

Basic SBI 4 T = text n = text length P = pattern m = pattern length ρ = compression ratio(0<ρ ≦ 1) r = pattern numbers i = length of index in bit I = length of index in byte J = jump of sampling T in byte

Preprocessing Stage Store all i-bitstrings as index if may partial matches. O(n/m) O(2^i+J) = O(n/m)

Sampling and Matching Stage Sample T (text) to get corresponding index Expend Partial Matches to Full Matches Avg. running time: O(n/m), if J = O(2^i) n/J*(c+J/(2^i)*1*c’) = O(n/J) = O(n/m), if J = O(2^i)

Performance Analysis Memory space: O(2^i+rm) Run time:  Avg. case: O(n/m), if J = O(2^i) O(n/m)+O(n/m) = O(n/m)  Worst case: O(nm) Worst case at SM stage: O(nm) n/J*(c+(1/1)*J*m) = O(n/J)+n*m = O(nm) →O(n/m)+O(nm) = O(nm)  Best case: O(n/m) Best case at SM stage: O(n/m) n/J*(c+0) = O(n/J) = O(n/m) →O(n/m)+O(n/m) = O(n/m)

Outline Basic SBI  Preprocessing Stage  Sampling and Matching Stage  Performance Analysis Variant SBI  For Multiple Pattern  For Bit Pattern Matching  For Less Memory Experimental Result (Avg. Runtime)  Single Pattern  Multiple Pattern  Bit Pattern  Different n and m

Variant for Multiple Pattern. O(n/m), if rJ=O(2^i) O(2^i+rJ)+n/J*(c+(rJ/2^i)*1*c’) = O(n/m), if rJ=(2^i)

Variant for Bit Pattern Matching J = m-I For p = 0 to 8J-1 do Get i-bitstring of P as idx at bit p Compare T and P bitwisely from idx

Variant for Bit Pattern Matching O(n/m), if 8J = O(2^i) O(2^i+8J)+n/J*(c+(8J/2^i)+1+c’) = O(n/m), if 8J = O(2^i)

Variant for Less Memory Space Only store valid index Binary Search Reduce memory space from O(2^i+rm) to O(rm) Avg. runtime: O(nlog(rm)/m)

Outline Basic SBI  Preprocessing Stage  Sampling and Matching Stage  Performance Analysis Variant SBI  For Multiple Pattern  For Bit Pattern Matching  For Less Memory Experimental Result (Avg. Runtime)  Single Pattern  Multiple Pattern  Bit Pattern  Different n and m

Avg. Runtime of Single Pattern Actual IP packets, size 300MB Pattern length 4 to 40

Avg. Runtime of Multiple Pattern Actual IP packets, size 300MB PLEN = 8 and PLEN = 16

Avg. Runtime of Bit Pattern Actual IP packets, size 300MB Pattern length 4 to 40

Basic SBI for different n and m Encrypted communication data Different number and same length patterns Different length text