By Topic

Variable-Length Hashing for Exact Pattern Matching

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$33 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

2 Author(s)
Dionisios Pnevmatikatos ; Foundation for Research and Technology-Hellas, Institute of Computer Science, Vasilika Vouton, Heraklion, Greece, pnevmati@ics.forth.gr, pnevmati@mhl.tuc.gr ; Aggelos Arelakis

HashMem is a memory based, exact pattern matching architecture for Snort-like intrusion detection. It uses CRC- style functions to determine a unique location for a possible match and then matches the input against the pattern stored in the specified memory location. This approach achieves is a very low logic and a reasonable memory cost. In this paper we extend the HashMem architecture to allow storing of variable-length patterns in a single memory structure, reducing the number of required memory structures and comparators. In this way, we improve the density of the memories and reduce the necessary logic for CRC functions and comparators. These improvements allow V-HashMem to accommodate the newest Snort rule-set with modest memory and very low logic cost of about 0.06 logic cells per search pattern character. This logic cost is almost an order of magnitude smaller compared to other research. Variable length HashMem uses single-ported memories, thus allowing the simultaneous processing of two characters per cycle using the FPGA dual ported memories and additional logic. We also extend the V-HashMem architecture to include a header-ID field and support header matching information, a feature missing both from our own earlier work and many related systems.

Published in:

2006 International Conference on Field Programmable Logic and Applications

Date of Conference:

28-30 Aug. 2006