Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
10.1145/3485832.3485878acmotherconferencesArticle/Chapter ViewAbstractPublication PagesacsacConference Proceedingsconference-collections
research-article

Reinhardt: Real-time Reconfigurable Hardware Architecture for Regular Expression Matching in DPI

Published: 06 December 2021 Publication History

Abstract

Regular expression (regex) matching is an integral part of deep packet inspection (DPI) but a major bottleneck due to its low performance. For regex matching (REM) acceleration, FPGA-based studies have emerged and exploited parallelism by matching multiple regex patterns concurrently. However, even though guaranteeing high-performance, existing FPGA-based regex solutions do not still support dynamic updates in run time. Hence, it was inappropriate as a DPI function due to frequently altered malicious signatures. In this work, we introduce Reinhardt, a real-time reconfigurable hardware architecture for REM. Reinhardt represents regex patterns as a combination of reconfigurable cells in hardware and updates regex patterns in real-time while providing high performance. We implement the prototype using NetFPGA-SUME, and our evaluation demonstrates that Reinhardt updates hundreds of patterns within a second and achieves up to 10 Gbps throughput (max. hardware bandwidth). Our case studies show that Reinhardt can operate as NIDS/NIPS and as the REM accelerator for them.

References

[1]
2021. CVE Detail. https://www.cvedetails.com.
[2]
2021. Titan IC RXP. https://www.mellanox.com/titan-ic.
[3]
Mohammad Aazam and Eui-Nam Huh. 2015. E-HAMC: Leveraging Fog computing for emergency alert service. In 2015 IEEE International Conference on Pervasive Computing and Communication Workshops (PerCom Workshops). IEEE, 518–523.
[4]
Tamer AbuHmed, Abedelaziz Mohaisen, and DaeHun Nyang. 2008. A survey on deep packet inspection for intrusion detection systems. arXiv preprint arXiv:0803.0037(2008).
[5]
Patrick Kwadwo Agyapong, Mikio Iwamura, Dirk Staehle, Wolfgang Kiess, and Anass Benjebbour. 2014. Design considerations for a 5G network architecture. IEEE Communications Magazine 52, 11 (2014), 65–75.
[6]
Igor M Araújo, Carlos Natalino, Ádamo L Santana, and Diego L Cardoso. 2018. Accelerating VNF-based Deep Packet Inspection with the use of GPUs. In 2018 20th International Conference on Transparent Optical Networks (ICTON). IEEE, 1–4.
[7]
Kubilay Atasu, Raphael Polig, Jonathan Rohrer, and Christoph Hagleitner. 2013. Exploring the design space of programmable regular expression matching accelerators. Journal of Systems Architecture 59, 10 (2013), 1184–1196.
[8]
Zachary K Baker, Hong-Jip Jung, and Viktor K Prasanna. 2006. Regular expression software deceleration for intrusion detection systems. In 2006 International Conference on Field Programmable Logic and Applications. IEEE, 1–8.
[9]
Joao Bispo, Ioannis Sourdis, Joao MP Cardoso, and Stamatis Vassiliadis. 2006. Regular expression matching for reconfigurable packet inspection. In Field Programmable Technology, 2006. FPT 2006. IEEE International Conference on. IEEE, 119–126.
[10]
Joao Bispo, Ioannis Sourdis, Joao MP Cardoso, and Stamatis Vassiliadis. 2007. Synthesis of regular expressions targeting fpgas: Current status and open issues. In International Workshop on Applied Reconfigurable Computing. Springer, 179–190.
[11]
Benjamin C Brodie, David E Taylor, and Ron K Cytron. 2006. A scalable architecture for high-throughput regular-expression pattern matching. In 33rd International Symposium on Computer Architecture (ISCA’06). IEEE, 191–202.
[12]
Shuai Che, Jie Li, Jeremy W Sheaffer, Kevin Skadron, and John Lach. 2008. Accelerating compute-intensive applications with GPUs and FPGAs. In 2008 Symposium on Application Specific Processors. IEEE, 101–107.
[13]
Check Point Software Technologies Ltd.2019. How quick are turn-around times for IPS signature updates addressing newly found vulnerabilities. https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98937.
[14]
Hao Chen, Yu Chen, and Douglas H Summerville. 2010. A survey on the application of FPGAs for network infrastructure security. IEEE Communications Surveys & Tutorials 13, 4 (2010), 541–561.
[15]
Jason Cong, Zhenman Fang, Michael Lo, Hanrui Wang, Jingxian Xu, and Shaochong Zhang. 2018. Understanding performance differences of FPGAs and GPUs. In 2018 IEEE 26th Annual International Symposium on Field-Programmable Custom Computing Machines (FCCM). IEEE, 93–96.
[16]
Ben Cope, Peter YK Cheung, Wayne Luk, and Lee Howes. 2010. Performance comparison of graphics processors to reconfigurable logic: A case study. IEEE Transactions on computers 59, 4 (2010), 433–448.
[17]
CORSA. 2019. Is Your Network Security Keeping Up?https://www.corsa.com/wp-content/uploads/PDFs/Corsa_WP-Is_Your_Network_Security_Keeping_Up.pdf.
[18]
Emerging Threats. 2021. Emerging Threats Rulesets. https://rules.emergingthreats.net, https://doc.emergingthreats.net.
[19]
GSMECIEG ETSI. 2015. 004, Mobile Edge Computing (MEC) Service Scenarios V1. 1.1,(2015).
[20]
Gilberto Fernandes, Joel JPC Rodrigues, Luiz Fernando Carvalho, Jalal F Al-Muhtadi, and Mario Lemes Proença. 2019. A comprehensive survey on network anomaly detection. Telecommunication Systems 70, 3 (2019), 447–489.
[21]
FierceWireless. 2019. Deep Packet Inspection: Getting the Most Out of 5G. https://www.fiercewireless.com/sponsored/deep-packet-inspection-getting-most-out-5g.
[22]
FireEye. 2021. FireEye Dynamic Threat Intelligence Cloud. https://www.threatprotectworks.com/Dynamic-Threat-Intelligence-cloud.asp.
[23]
Daniel Firestone, Andrew Putnam, Sambhrama Mundkur, Derek Chiou, Alireza Dabagh, Mike Andrewartha, Hari Angepat, Vivek Bhanu, Adrian Caulfield, Eric Chung, 2018. Azure Accelerated Networking: SmartNICs in the Public Cloud. In 15th USENIX Symposium on Networked Systems Design and Implementation (NSDI 18), Renton, WA.
[24]
Jeremy Fowers, Greg Brown, Patrick Cooke, and Greg Stitt. 2012. A performance and energy comparison of FPGAs, GPUs, and multicores for sliding-window applications. In Proceedings of the ACM/SIGDA international symposium on Field Programmable Gate Arrays. ACM, 47–56.
[25]
Thilan Ganegedara, Yi-Hua E Yang, and Viktor K Prasanna. 2010. Automation framework for large-scale regular expression matching on FPGA. In 2010 International Conference on Field Programmable Logic and Applications. IEEE, 50–55.
[26]
Melvin B Greer Jr and John W Ngo. 2012. Personal emergency preparedness plan (pepp) facebook app: Using cloud computing, mobile technology, and social networking services to decompress traditional channels of communication during emergencies and disasters. In 2012 IEEE Ninth International Conference on Services Computing. IEEE, 494–498.
[27]
PK Gupta. 2016. Accelerating datacenter workloads. In 26th International Conference on Field Programmable Logic and Applications (FPL).
[28]
Philip Hazel. 2005. Pcre: Perl compatible regular expressions. Online http://www.pcre.org(2005).
[29]
Tran Trung Hieu, Tran Ngoc Thinh, and Shigenori Tomiyama. 2013. ENREM: An efficient NFA-based regular expression matching engine on reconfigurable hardware for NIDS. Journal of Systems Architecture 59, 4-5 (2013), 202–212.
[30]
Brad L Hutchings, Rob Franklin, and Daniel Carver. 2002. Assisting network intrusion detection with reconfigurable hardware. In Field-Programmable Custom Computing Machines, 2002. Proceedings. 10th Annual IEEE Symposium on. IEEE, 111–120.
[31]
Joel Hypolite, John Sonchack, Shlomo Hershkop, Nathan Dautenhahn, André DeHon, and Jonathan M Smith. 2020. DeepMatch: practical deep packet inspection in the data plane using network processors. In Proceedings of the 16th International Conference on emerging Networking EXperiments and Technologies. 336–350.
[32]
Jonghwan Hyun, Jian Li, ChaeTae Im, Jae-Hyoung Yoo, and James Won-Ki Hong. 2014. A VoLTE traffic classification method in LTE network. In The 16th Asia-Pacific Network Operations and Management Symposium. IEEE, 1–6.
[33]
InfoSecurity. 2019. Advanced Malware Detection - Signatures vs. Behavior Analysis. https://www.infosecurity-magazine.com/opinions/malware-detection-signatures/.
[34]
Intel. 2019. Hyperscan. https://github.com/intel/hyperscan.
[35]
Intel. 2021. Intel DPDK: Data Plane Development Kit. http://dpdk.org.
[36]
Intel 01.org. 2019. Hyperscan sample data. https://01.org/downloads/sample-data-hyperscan-hsbench-performance-measurement.
[37]
Theo Jepsen, Daniel Alvarez, Nate Foster, Changhoon Kim, Jeongkeun Lee, Masoud Moshref, and Robert Soulé. 2019. Fast string searching on pisa. In Proceedings of the 2019 ACM Symposium on SDN Research. 21–28.
[38]
Adam Johnson and Kenneth Mackenzie. 2001. Pattern matching in reconfigurable logic for packet classification. In Proceedings of the 2001 international conference on Compilers, architecture, and synthesis for embedded systems. ACM, 126–130.
[39]
Sailesh Kumar. 2007. Survey of current network intrusion detection techniques. Washington Univ. in St. Louis(2007), 1–18.
[40]
Christopher Lavin, Brent Nelson, and Brad Hutchings. 2013. Impact of hard macro size on FPGA clock rate and place/route time. In 2013 23rd International Conference on Field programmable Logic and Applications. IEEE, 1–6.
[41]
Christopher Lavin, Marc Padilla, Jaren Lamprecht, Philip Lundrigan, Brent Nelson, and Brad Hutchings. 2011. HMFlow: accelerating FPGA compilation with hard macros for rapid prototyping. In 2011 IEEE 19th Annual International Symposium on Field-Programmable Custom Computing Machines. IEEE, 117–124.
[42]
Bojie Li, Kun Tan, Layong Larry Luo, Yanqing Peng, Renqian Luo, Ningyi Xu, Yongqiang Xiong, Peng Cheng, and Enhong Chen. 2016. Clicknp: Highly flexible and high performance network processing with reconfigurable hardware. In Proceedings of the 2016 ACM SIGCOMM Conference. ACM, 1–14.
[43]
Cheng-Hung Lin and Cheng-Hung Hsieh. 2018. A novel hierarchical parallelism for accelerating NIDS using GPUs. In 2018 IEEE International Conference on Applied System Invention (ICASI). IEEE, 578–581.
[44]
Cheng-Hung Lin, Chih-Tsun Huang, Chang-Ping Jiang, and Shih-Chieh Chang. 2007. Optimization of pattern matching circuits for regular expression on FPGA. IEEE Transactions on Very Large Scale Integration (VLSI) Systems 15, 12(2007), 1303–1310.
[45]
Cheng-Hung Lin, Chen-Hsiung Liu, Lung-Sheng Chien, and Shih-Chieh Chang. 2012. Accelerating pattern matching using a novel parallel algorithm on GPUs. IEEE Trans. Comput. 62, 10 (2012), 1906–1916.
[46]
Andrew Love, Wenwei Zha, and Peter Athanas. 2013. In pursuit of instant gratification for FPGA design. In 2013 23rd International Conference on Field programmable Logic and Applications. IEEE, 1–8.
[47]
Ning Lu, Nan Cheng, Ning Zhang, Xuemin Shen, and Jon W Mark. 2014. Connected vehicles: Solutions and challenges. IEEE internet of things journal 1, 4 (2014), 289–299.
[48]
Abhishek Mitra, Walid Najjar, and Laxmi Bhuyan. 2007. Compiling pcre to fpga for accelerating snort ids. In Proceedings of the 3rd ACM/IEEE Symposium on Architecture for networking and communications systems. ACM, 127–136.
[49]
Mitre. 2021. Common Vulnerabilities and Exposures (CVE). https://cve.mitre.org/.
[50]
Hiroki Nakahara, Tsutomu Sasao, and Munehiro Matsuura. 2010. A regular expression matching circuit based on a modular non-deterministic finite automaton with multi-character transition. In Proc. 16th Workshop on Synthesis And System Integration of Mixed Information technologies. 359–364.
[51]
Hiroki Nakahara, Tsutomu Sasao, and Munehiro Matsuura. 2012. A design method of a regular expression matching circuit based on decomposed automaton. IEICE TRANSACTIONS on Information and Systems 95, 2 (2012), 364–373.
[52]
NetFPGA. 2014. NetFPGA-SUME board. https://netfpga.org/site/#/systems/1netfpga-sume/details/.
[53]
NetFPGA-SUME. 2020. NetFPGA SUME Reference NIC. https://github.com/NetFPGA/NetFPGA-SUME-public/wiki/NetFPGA-SUME-Reference-NIC.
[54]
Tien-Thinh Nguyen, Christian Bonnet, and Jérôme Harri. 2016. SDN-based distributed mobility management for 5G networks. In 2016 IEEE Wireless Communications and Networking Conference. IEEE, 1–7.
[55]
Nping. 2021. An Open source network packet generation. https://nmap.org/nping/.
[56]
Panos Papadimitratos, Arnaud De La Fortelle, Knut Evenssen, Roberto Brignolo, and Stefano Cosenza. 2009. Vehicular communication systems: Enabling technologies, applications, and future outlook on intelligent transportation. IEEE communications magazine 47, 11 (2009), 84–95.
[57]
Taejune Park and Seungwon Shin. 2021. Mobius: Packet re-processing hardware architecture for rich policy handling on a network processor. Journal of Network and Systems Management 29, 1 (2021), 1–26.
[58]
PcapPlusPlus. 2020. DpdkBridge. https://github.com/seladb/PcapPlusPlus/tree/master/Examples/DpdkBridge.
[59]
Pupuweb. 2019. Deep Packet Inspection (DPI) and 5G: Network Visibility and Real-time Application Awareness. https://pupuweb.com/dpi-5g-network-visibility-real-time-application-awareness/.
[60]
Andrew Putnam, Adrian M Caulfield, Eric S Chung, Derek Chiou, Kypros Constantinides, John Demme, Hadi Esmaeilzadeh, Jeremy Fowers, Gopi Prashanth Gopal, Jan Gray, 2014. A reconfigurable fabric for accelerating large-scale datacenter services. ACM SIGARCH Computer Architecture News 42, 3 (2014), 13–24.
[61]
RAPID7. 2017. The Pros & Cons of Intrusion Detection Systems. https://blog.rapid7.com/2017/01/11/the-pros-cons-of-intrusion-detection-systems/.
[62]
Reetinder Sidhu and Viktor K Prasanna. 2001. Fast regular expression matching using FPGAs. In Field-Programmable Custom Computing Machines, 2001. FCCM’01. The 9th Annual IEEE Symposium on. IEEE, 227–238.
[63]
David Sidler, Zsolt István, Muhsen Owaida, and Gustavo Alonso. 2017. Accelerating pattern matching queries in hybrid CPU-FPGA architectures. In Proceedings of the 2017 ACM International Conference on Management of Data. 403–415.
[64]
Snort. 2021. Network Intrusion Detection System. https://www.snort.org/.
[65]
Ioannis Sourdis, João Bispo, Joao MP Cardoso, and Stamatis Vassiliadis. 2008. Regular expression matching in reconfigurable hardware. Journal of Signal Processing Systems 51, 1 (2008), 99–121.
[66]
Suricata. 2021. An open source-based intrusion detection system (IDS). https://suricata-ids.org/.
[67]
Symantec. 2002. Managing Intrusion Detection Systems in Large Organizations, Part One. https://www.symantec.com/connect/articles/managing-intrusion-detection-systems-large-organizations-part-one.
[68]
Qiu Tang, Lei Jiang, Xin-xing Liu, and Qiong Dai. 2014. A real-time updatable FPGA-based architecture for fast regular expression matching. Procedia Computer Science 31 (2014), 852–859.
[69]
Gautam S Thakur, Mukul Sharma, and Ahmed Helmy. 2010. Shield: Social sensing and help in emergency using mobile devices. In 2010 IEEE Global Telecommunications Conference GLOBECOM 2010. IEEE, 1–5.
[70]
David Barrie Thomas, Lee Howes, and Wayne Luk. 2009. A comparison of CPUs, GPUs, FPGAs, and massively parallel processor arrays for random number generation. In Proceedings of the ACM/SIGDA international symposium on Field programmable gate arrays. ACM, 63–72.
[71]
Ken Thompson. 1968. Programming techniques: Regular expression search algorithm. Commun. ACM 11, 6 (1968), 419–422.
[72]
Udaya Tupakula, Vijay Varadharajan, and Naveen Akku. 2011. Intrusion detection techniques for infrastructure as a service cloud. In 2011 IEEE Ninth International Conference on Dependable, Autonomic and Secure Computing. IEEE, 744–751.
[73]
Elisabeth Uhlemann. 2015. Introducing connected vehicles [connected vehicles]. IEEE Vehicular Technology Magazine 10, 1 (2015), 23–31.
[74]
Jan Van Lunteren. 2006. High-performance pattern-matching for intrusion detection. In Proceedings IEEE INFOCOM 2006. 25TH IEEE International Conference on Computer Communications. Citeseer, 1–13.
[75]
Giorgos Vasiliadis, Spiros Antonatos, Michalis Polychronakis, Evangelos P Markatos, and Sotiris Ioannidis. 2008. Gnort: High performance network intrusion detection using graphics processors. In International Workshop on Recent Advances in Intrusion Detection. Springer, 116–134.
[76]
Giorgos Vasiliadis, Michalis Polychronakis, Spiros Antonatos, Evangelos P Markatos, and Sotiris Ioannidis. 2009. Regular expression matching on graphics hardware for intrusion detection. In International Workshop on Recent Advances in Intrusion Detection. Springer, 265–283.
[77]
Hao Wang, Shi Pu, Gabe Knezek, and Jyh-Charn Liu. 2013. Min-max: A counter-based algorithm for regular expression matching. IEEE Transactions on Parallel and Distributed Systems 24, 1 (2013), 92–103.
[78]
Xiang Wang, Yang Hong, Harry Chang, KyoungSoo Park, Geoff Langdale, Jiayu Hu, and Heqing Zhu. 2019. Hyperscan: a fast multi-pattern regex matcher for modern CPUs. In 16th USENIX Symposium on Networked Systems Design and Implementation (NSDI 19). 631–648.
[79]
Chengcheng Xu, Shuhui Chen, Jinshu Su, Siu-Ming Yiu, and Lucas CK Hui. 2016. A survey on regular expression matching for deep packet inspection: Applications, algorithms, and hardware platforms. IEEE Communications Surveys & Tutorials 18, 4 (2016), 2991–3029.
[80]
Norio Yamagaki, Reetinder Sidhu, and Satoshi Kamiya. 2008. High-speed regular expression matching engine using multi-character NFA. In Field Programmable Logic and Applications, 2008. FPL 2008. International Conference on. IEEE, 131–136.
[81]
Yi-Hua Yang and Viktor Prasanna. 2012. High-performance and compact architecture for regular expression matching on FPGA. IEEE Trans. Comput. 61, 7 (2012), 1013–1025.
[82]
Yi-Hua E Yang, Weirong Jiang, and Viktor K Prasanna. 2008. Compact architecture for high-throughput regular expression matching on FPGA. In Proceedings of the 4th ACM/IEEE Symposium on Architectures for Networking and Communications Systems. ACM, 30–39.
[83]
Yi-Hua E Yang and Viktor K Prasanna. 2011. Space-time tradeoff in regular expression matching with semi-deterministic finite automata. In 2011 Proceedings IEEE INFOCOM. IEEE, 1853–1861.
[84]
Zeek (Bro). 2021. The Zeek (Bro) Network Security Monitor. https://www.zeek.org/.
[85]
Noa Zilberman, Yury Audzevich, G Adam Covington, and Andrew W Moore. 2014. NetFPGA SUME: Toward 100 Gbps as research commodity. IEEE micro 34, 5 (2014), 32–41.

Cited By

View all
  • (2023)OD-REM: On-Demand Regular Expression Matching on FPGAs for Efficient Deep Packet Inspection2023 International Conference on Field Programmable Technology (ICFPT)10.1109/ICFPT59805.2023.00029(217-226)Online publication date: 12-Dec-2023
  • (2022)MECaNIC: SmartNIC to Assist URLLC Processing in Multi-Access Edge Computing Platforms2022 IEEE 30th International Conference on Network Protocols (ICNP)10.1109/ICNP55882.2022.9940263(1-12)Online publication date: 30-Oct-2022
  • (2022)FRA-FPGA: Fast Reconfigurable Automata Processing on FPGAs2022 32nd International Conference on Field-Programmable Logic and Applications (FPL)10.1109/FPL57034.2022.00055(313-321)Online publication date: Aug-2022

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Other conferences
ACSAC '21: Proceedings of the 37th Annual Computer Security Applications Conference
December 2021
1077 pages
ISBN:9781450385794
DOI:10.1145/3485832
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 06 December 2021

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. Deep Packet Inspection
  2. Hardware
  3. Pattern matching
  4. Regex

Qualifiers

  • Research-article
  • Research
  • Refereed limited

Funding Sources

Conference

ACSAC '21

Acceptance Rates

Overall Acceptance Rate 104 of 497 submissions, 21%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)42
  • Downloads (Last 6 weeks)4
Reflects downloads up to 26 Jan 2025

Other Metrics

Citations

Cited By

View all
  • (2023)OD-REM: On-Demand Regular Expression Matching on FPGAs for Efficient Deep Packet Inspection2023 International Conference on Field Programmable Technology (ICFPT)10.1109/ICFPT59805.2023.00029(217-226)Online publication date: 12-Dec-2023
  • (2022)MECaNIC: SmartNIC to Assist URLLC Processing in Multi-Access Edge Computing Platforms2022 IEEE 30th International Conference on Network Protocols (ICNP)10.1109/ICNP55882.2022.9940263(1-12)Online publication date: 30-Oct-2022
  • (2022)FRA-FPGA: Fast Reconfigurable Automata Processing on FPGAs2022 32nd International Conference on Field-Programmable Logic and Applications (FPL)10.1109/FPL57034.2022.00055(313-321)Online publication date: Aug-2022

View Options

Login options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

HTML Format

View this article in HTML Format.

HTML Format

Figures

Tables

Media

Share

Share

Share this Publication link

Share on social media