A TCAM-based String Matching Algorithm for Network Intrusion Detection System

String matching plays an important role in Network Intrusion Detection System(NIDS), including functions like URL filtering and protocol recognition, etc.. This paper proposes a high-speed string matching algorithm based on TCAM to implement fixed-offset and float-offset matching at the same time. Floating-offset strings are stored in TCAM at byte-by-byte offsets, occupying multiple TCAM entries; fixed-offset strings use quotient and residual values of offsets divided by skip distance to represent the matching position, occupying only a single TCAM entry. The input text is segmented and then sent to the TCAM for matching along with current skip count. Both floating-offset strings and fixed-offset strings can be matched in a single pass. This matching algorithm was implemented using NPS-400 network processor and NLA122048 TCAM, which can achieve a matching performance of 100Gbps under a scale of 10K string patterns in NIDS system.