1. A Fast Scalable Automaton-Matching Accelerator for Embedded Content Processors
KUO-KUN TSENG, YUAN-CHENG LAI, YING-DAR LIN, and TSERN-HUEI LEE
ACM Transactions on Embedded Computing Systems, April 2009.
Also appeared in AINAW 2007, SYSARC 2007.

2. FSAM Fast scalable automaton-matching
Bitmap-AC (INFOCOM 2004) based DPI
Goal: Faster matching speed with space tradeoff
Two techniques:
Root-Index matching: for root state
Pre-hash matching: for non-root states

3. Aho-Corasick Forward Transitions (To Deeper states)
Given a states s,
Depth(s): Depth(S4) = 2, Depth(S13) = 3
Label(s): Label(S4) = BD, Label(S13) = BCA
Label(S12) = CDBCAB
Forward Transitions (To Deeper states)
Failure Transitions
Failure Transitions to S0 are omitted

4. State Structure (1/3) Lookup Table Format
Lookup Table format used in:
(# of Forward transitions) more than 64.

5. State Structure(2/3) Linear Format
S4 (S0)
S5 (S7) D S6
S2 (S0) C S5 D S4 E S3

6. State Structure (3/3) Bitmap Format
S5 (S7)
00010 S6
S2 (S0)
00111 S5 S4 S3

7. FSAM Algorithm Three Components: 1. Root-Index Matching
2. PreHash Matching
3. AC Matching (Bitmap-AC Matching)

8. PreHash (Overview)

9. PreHash (Idea) Using for non-root states.
Quickly test multiple suffixes of the current state to avoid slow Bitmap AC matching (bitmap testing).
Per-state vectors to keep the valid suffix information.
Failure Transitions are included in valid suffix consideration.
Testing result:
Miss: Return to root state
Hit: do Bitmap-AC matching

10. PreHash (Example)

11. Root-Index (Idea) Using for root state (S0) only
Goal: Process multiple characters
Issue: Memory explosion
256*256*256 …
Solution: RFC-like (SIGCOMM 1999) data structure

12. Root-Index (Example)

13. Architecture (FPGA-based)

14. Parameter URL Patterns (SquidGuard) 194,096 states
BitmapAC (SizeAC 6.85 MB)
Kroot = 4 (Sizeroot 7.5 MB)
Kprehash = 2 (Sizeprehash 3.23 MB)
Virus Patterns (ClamAV)
402,173 states
BitmapAC (SizeAC MB)
Kroot = 2 (Sizeroot 0.25 MB)
Kprehash = 2 (Sizeprehash 4.97 MB)