1. Author : Masanori Bando, N. Sertac Artan and H. Jonathan Chao Publisher : Parallel & Distributed Processing, Workshops and Phd Forum (IPDPSW), 2010 Presenter : Jo-Ning Yu Date : 2011/05/11

2.   Example  LaFA Architecture  Correlation Block  Detection Block  Evaluations 2 Outline

3.  Example 3

4.   Detection Block : detect the simple strings and variable strings in the input string.  Correlation block : correlate detected Events ( ＊ ) to determine whether the input matches any of the RegExes in its RegEx set. ＊ The match signal is called an Event in this paper. LaFA Architecture 4

5.  5 Correlation Block n = 3

6.   RegEx1 : abc[a-z]op S 1 V 1 S 2  RegEx4 : abc[^x]{3}xyz S 1 V 2 S 3 Timing History 6

7.  Node Infomation 7

8.  Correlation Block 8

9.   Buffered Lookup Modules  The modules use previously detected character histories to verify a queried variable string.  T ime L ookup M odule (TLM)  C ontents L ookup M odule (CLM)  F requently appearing R epetition detection M odule (FRM)  S hort simple string D etection M odule (SDM)  In-line Lookup Module  The module processes incoming characters in real time.  R epetition D etection M odule(RDM) Detection Modules 9

10.   TLM detects character classes and negated character classes with no repetition, ex : [a-z], or [ˆ0-9].  TLM incorporates an input buffer, which stores characters recently received from a packet in chronological order.  Ex: Time Lookup Module (TLM) 10

11.  TLM Architecture 11

12.   CLM detects negated single characters with repetitions, ex : [ˆa]{3}, [ˆa]{3,5}, or [ˆa]{3,}.  CLM stores timestamps of every ASCII character. Thus, 256 memory locations are reserved, each for one ASCII character.  Ex: Contents Lookup Module (CLM) 12

13.  13 CLM Architecture C = 8

14.   RDM detects character classes and negated character classes with repetitions, ex : [a-z]{3}, [a-z]{3,5}, and [a-z]{3,} ( base{min, max} ).  The RDM is the only in-line detection module.  Once number of repetitions reaches to the minimum repetition value, a next simple string is activated. The next simple string inactivate when number of repetitions reaches to the maximum repetition value.  Ex: Repetition Detection Module (RDM) 14

15.  15 RDM Architecture R = 2

16.   The FRM can detect any type of repetition using a buffered lookup approach.  FRM can be shared among multiple RegExes that helps to improve resource efficiency.  When the sequence breaks, the count and timestamp are stored in a history memory inside of the FRM. Frequently Appearing Repetition Detection Module (FRM) 16

17.  17 FRM Architecture F = 4

18.   We classify strings with less than 5 characters as a short simple string.  It naturally generate more Events.  The SDM architecture is very similar to the TLM except that in the SDM, there are multiple memory blocks to support multiple character lookups at a clock cycle. Short Simple String Detection Module (SDM) 18

19.  19 SDM Architecture

20.  ＊ SSD : Simple String Detector[11] Evaluations 20

21.   Memory Requirements for the System 21 Evaluations

22.   The design is running at a clock frequency of 250MHz, which is equivalent to 2Gbps detection throughput per engine.  Xilinx Virtex-6 FPGA contains 32Mbits of block RAM. Since 17 LaFA engine can fit in the FPGA, we expect the total throughput can reach to 34Gbps. 22 Evaluations