Memory architectures have been widely adopted in network intrusion detection system for inspecting malicious packets due to their flexibility and scalability. Traditional memory architectures match input streams against thousands of attack patterns by traversing the corresponding state transition table stored in a two-dimensional memory. It’s well-known that using two-dimensional memory is time-efficient for retrieving next state information, but is extremely space-inefficient because most of memories are wasted.
In this paper, we propose a novel memory architecture using perfect hashing to condense state transition tables without hash collisions. The proposed perfect hashing memory architecture achieves up to 99.5% of memory reduction compared to two-dimensional memory architectures. We have implemented the novel memory architecture on graphic processing units. The proposed architecture is tested using attack patterns from Snort V2.8 and input packets from DEFCON. The experimental results show that the proposed algorithm outperforms state-of-the-art memory architectures both on performance and memory efficiency.

因為記憶體架構的靈活性與可擴展性，在網路威脅偵測系統中，廣泛的使用記憶體架構來檢驗惡意的封包。傳統的記憶體架構藉由traverse儲存在二維記憶體中的state transition table，比對輸入串流與數以千計的攻擊性pattern。眾所周知，使用二維記憶體架構來擷取next state的資訊相當快速，但是極度浪費空間，因為大部分的記憶體空間是沒有使用到的。
在這篇論文中，我們提出了一個新的記憶體架構，採用perfect hashing來壓縮state transition tables，並且避免了hash collision的問題。我們提出的perfect hashing記憶體架構，相較於二維記憶體架構可以減少99.5%的記憶體使用。我們將此新的記憶體架構實作於圖形處理器，並且以Snort V2.8的攻擊pattern與DEFCOM的輸入封包來測試。實驗結果顯示，我們提出的新方法在效能及記憶體使用都優於其他最先進的記憶體架構。

[1] A. V. Aho and M. J. Corasick, "Efficient string matching: an aid to bibliographic search," Commun. ACM, vol. 18, pp. 333-340, 1975.
[2] Z. J. Czech, G. Havas, B. S. Majewski, Perfect Hashing, Theoretical Computer Science, Volume 182 Issue 1-2, 1997.
[3] C.-H. Lin, et al., "Accelerating String Matching Using Multi-Threaded Algorithm on GPU," in GLOBECOM 2010, 2010 IEEE Global Telecommunications Conference, 2010, pp. 1-5.
[4] J. v. Lunteren, "High-Performance Pattern-Matching for Intrusion Detection", INFOCOM 2006. 25th IEEE International Conference on Computer Communications. Proceedings, On page(s): 1 - 13, Volume: Issue: , April 2006
[5] M. Roesch. "Snort- lightweight Intrusion Detection for networks," in Proceedings of LISA99, the 15th Systems Administration Conference, 1999
[6] T. Song, et al., "A Memory Efficient Multiple Pattern Matching Architecture for Network Security," in INFOCOM 2008. The 27th Conference on Computer Communications. IEEE, 2008, pp. 166-170.
[7] L. Tan and T. Sherwood, "A high throughput string matching architecture for intrusion detection and prevention," in Computer Architecture, 2005. ISCA '05. Proceedings. 32nd International Symposium on, 2005, pp. 112-122.
[8] N. Tuck, et al., "Deterministic memory-efficient string matching algorithms for intrusion detection," in INFOCOM 2004. Twenty-third Annual Joint Conference of the IEEE Computer and Communications Societies, 2004, pp. 2628-2639 vol.4.
[9] DEFCON, Available: http://cctf.shmoo.com
[10] NVIDIA Corporation. NVIDIA CUDA programming Guide, 2010 Available: http://developer.nvidia.com
[11] PFAC library, Available: http://code.google.com/p/pfac/