1. High Performance String Matching Algorithm for a Network Intrusion Prevention Systems (NIPS)
Author：
Yaron Weinsberg ,Shimrit Tzur-David ,Danny Dolev
and Tal Anker
Publisher：
High Performance Switching and Routing , 2006
Presenter：
Tsung-Lin Hsieh
Date：
2011/09/28

2. Outline
Introduction
RTCAM algorithm
Experimental Results

3. Introduction
The pattern-matching algorithm must be able to operate at wire speed.
With networking speeds doubling every year, it is becoming increasingly difficult for software-based solutions to keep up with the line rates.
This paper presents a novel pattern matching algorithm, called RTCAM (Rotating TCAM), which suggests the usage of an off-the-shelf TCAM and some additional logic that can be implemented in HW.

4. Example of snort’s rules
within- the maximum number of bytes allowed between two successive pattern matches.
offset - indicates from where in the packet the pattern should be searched.
distance - the minimum number of bytes allowed between two successive matches.
depth - how far into the packet the algorithm should search for the specified pattern.

5. RTCAM Algorithm Populating the TCAM : two phases
Phase I: Split Patterns into w size chunks.
Phase II: Create shifted sub-patterns for each prefix by shifting prefix to right and adding don’t care bits. *
* : Thus the name Rotating TCAM

6. RTCAM Algorithm
Populating the TCAM
w = 4

7. RTCAM Algorithm Procedure:
Construct key of size w bytes at a position pos in packet payload with initial pos = 0.
Perform TCAM Lookup.
If associated shift value is not equal to zero then repeat first step after shift specified.
If zero, then match occurs. Use associated data structures to access possible pattern. Build sub-patterns iteratively and use TCAM for lookup. A complete match only occurs when all sub-patterns match with shift of zero.
Repeat first step with a shift of one.

8. RTCAM Algorithm Patterns List :
TCAM_Ptrs used when pattern’s length is greater than w

9. RTCAM Algorithm TCAM Rules Table (TRT) : correlate a TCAM row
and the patterns list.

10. RTCAM Algorithm
Matched Pattern List :
Rules List :

11. RTCAM Algorithm Example : Input Packet =“WWABCDEFTXYZABCDARP“
Matched Against

12. RTCAM Algorithm
“WWABCDEFTXYZABCDAR”

13. Experimental Results
Fully implemented a software version of an RTCAM-NIPS device written in Java and have tested our simulation with two complex pattern sets.
ClamAV [17] – Ver 0.82 ,26987 simple patterns
Snort [3]
The input for our NIPS was comprised of a real packet trace from the MIT DARPA project [18]

14. Experimental Results
ClamAV rule set :
Snort rule set :

15. Experimental Results
Scanning Time Results :

16. Experimental Results
Scanning Time Results :

17. Experimental Results For a TCAM width of 24 :
Since the RTCAM algorithm accesses the SRAM every TCAM lookup ,the scan ratio is 2[12]
Average shift value is 7.4
SRAM access speed is 5 times of TCAM access speed
So ,throughput = (2*7.4) / (1+0.2) = 12.35Gbps
(60%)