A flexible wildcard pattern matching accelerator via simultaneous discrete finite automata

NXFEE INNOVATION
(SEMICONDUCTOR IP &PRODUCT DEVELOPMENT)
(ISO : 9001:2015Certified Company),
# 45, Vivekanandar Street, Dhevan kandappa Mudaliar nagar, Nainarmandapam,
Pondicherry– 605004, India.
Buy Project on Online :www.nxfee.com | contact : +91 9789443203 |
email : nxfee.innovation@gmail.com
_________________________________________________________________
A Flexible Wildcard-Pattern Matching Accelerator via Simultaneous
Discrete Finite Automata
Abstract:
Regular expression matching becomes indispensable elements of Internet of Things
network security. However, traditional ternary content addressable memory (TCAM)
search engine is unable to handle patterns with wildcards, as it precisely tracks only one
active state with single transition. This paper proposes a promising simultaneous pattern
matching methodology for wildcard patterns by two separated engines to represent
discrete finite automata. A key preprocessing to encode possible postfix pattern by a
unique key ensures that follow-up patterns can accurately traverse all possible matches
with limited hardware resources. This approach is practical and scalable for achieving
good performance and low space consumption in network security, and it can be
applicable to any regular expressions even with multi wildcard patterns. The
experimental results demonstrate that this scheme can efficiently and accurately
recognize wildcard patterns by simultaneously tracking only two active states. By
adopting SRAM TCAM in the proposed architecture, the energy consumption is reduced
to around 39%, compared with the energy consumption using a computing system that
contains a large memory lookup and comparison overhead.
Software Implementation:
 Modelsim
 Xilinx 14.2
Existing System:
With the recent rapid increase in the popularity of Internet of Things (IoT) in electronic
systems, security of networks has become a critical challenge because numerous small

NXFEE INNOVATION
_________________________________________________________________
networks merge into large networks. At the same time, limited hardware resources such
as communication channels/interfaces, bandwidth, storage, and energy cause various
potential vulnerabilities. An efficient design for deep packet inspection (DPI) is an
indispensable element because the security problems will be a key factor in IoT
development. In the existing pattern matching methods of DPI, regular expression
matching algorithms are widely used in networking
` Fig. 1. Architecture of firewall router
devices. These algorithms are expressive, efficient, and flexible in detecting attacks
because the payload of packets can be examined, regardless of whether any predefined

NXFEE INNOVATION
_________________________________________________________________
regular expressions are matched by regular expression matching algorithms. They
perform intrusion detection, attack detection duties, and provide antivirus defense such as
firewalls in layer-7 switches. Fig. 1 shows that a virus detection computing system, called
memory lookup implementation, is implemented by the processor and memory in the
firewall router to check the payload to confirm that the connection is secure.
However, the disadvantage of this architecture is its sequential comparison operations
and memory access. Recently, ternary content addressable memory (TCAM) based
search engines have been used to implement regular expression matching algorithms to
utilize their parallel comparison and “don’t care (X)” search abilities to achieve high
speeds. In this architecture, the state machine of regular expression can be efficiently
implemented because the number of transitions in the state machine is equal to the
number of TCAM entries. In addition, the patterns that spread across multiple packets in
a flow can be monitored by TCAM-based search engines because they run a unique state
machine for each flow. Unfortunately, TCAM-based search engines cannot be used to
recognize wildcard patterns, which are restricted by precisely one active state for tracking
and one state transition lookup. Detecting the match of unpredictable input strings in
wildcard patterns is in fact the most critical challenge because the nondeterministic nature
of wildcard patterns results in a large number of possible matches. Therefore, restrictions
on the search operation in the architecture and unpredictable match strings are the major
issues in this paper. Based on the above observations, we propose an efficient separated
TCAM search engine employing a clever simultaneous pattern matching methodology
that uses discrete finite automata (discrete-FA) for wildcard-pattern matching problems.
A key challenge of this design lies in having accurate traversal and traversing all possible
matches in an arbitrary number of characters that appear from a wildcard. In this paper,
we present algorithm/architecture code design techniques that can be used in hardware
implementation, to recognize whether input strings and wildcard patterns match with
limited hardware resources. We address several design issues, including how to design

NXFEE INNOVATION
_________________________________________________________________
the search engines using TCAM for wildcard pattern matching, how to construct the
discrete-FA for the predefined patterns, and how to detect the match of input strings that
have accurate traversal and traverse all match possibilities. In summary, the primary
contributions of this paper are as follows. paper are as follows.
1) We propose an efficient separated TCAM search engine architecture and a
simultaneous pattern matching methodology utilizing TCAM features to detect all
possible matches with limited hardware resources, which resolve the nondeterministic
nature of wildcard patterns that cause a large amount of possible potential matches. This
technique does not alter the data flow during search execution.
2) We construct discrete-FA by dividing a regular expression with wildcards to
recognize wildcard patterns, thereby enabling simultaneous search. This technique
resolves the problem of wildcard pattern matching with limited hardware resources and
does not require significant architectural modification.
3) We reduce the nondeterministic number of active states from O(N), where N is the
number of wildcard patterns, to O(1) in wildcard pattern matching by simultaneous
tracking only two active states with two transitions.
4) We present a cluster encoding method to significantly reduce the key size and resolve
ambiguity problems in the key assignment, thereby enabling TCAM capacity reduction
for wildcard pattern matching in the proposed work.
Disadvantages:
 Space consumption is lower
 Inaccuracy in recognizing wildcard patterns
 Energy consumption is higher
Proposed System:

NXFEE INNOVATION
_________________________________________________________________
Efficient separated TCAM search engines
In this section, we first describe a new wildcard-pattern matching architecture, separated
TCAM search engine architecture, which combines two traditional TCAM search engines
and a simultaneous matching engine. It has accurate traversal and detects all possible
matches to achieve fast and scalable regular expression matching with wildcard patterns.
The proposed architecture utilizes the unique parallel and wildcard matching capabilities
of TCAM to recognize input strings, unlike the existing solutions that use memory
lookup methodology to determine the match by sequential memory access. Next, we
describe a simultaneous patter matching scheme that employs discrete-FA to recognize
wildcard patterns in the proposed architecture. The prefix and suffix state machines in the
discrete-FA can be searched independently for detecting all possible matches of wildcard
patterns. Finally, a cluster encode method is proposed to ensure that follow-up patterns
can accurately traverse all possible matches by a unique key without ambiguity
Hardware Architecture
In the proposed architecture, simultaneous pattern matching methodology is proposed to
recognize wildcard patterns in regular expressions to resolve architecture restrictions in
traditional TCAM-based search engines. The proposed separated TCAM search engine
consists of three major components, which includes two small isolated TCAM search
engines and a simultaneous matching engine, as shown in Fig. 1. We define a state flag, a
key, and a segment ID, which serve as the simultaneous pattern matching methodology of
each state in each search engine. In our observations, we find that using two active states
with two transitions were sufficient to recognize wildcard patterns in the simultaneous
pattern matching methodology. Therefore, two isolated search engines are used to
implement different state machines that are constructed by the prefix segment and suffix
segment of patterns. This means that the state machine of the prefix segment and suffix
segment can be searched concurrently. This is plotted in Fig. 1(a) and (b).

NXFEE INNOVATION
_________________________________________________________________
Simultaneous Matching Engine:
The proposed simultaneous matching engine consists of three major components as
shown in Fig. 1(c). The first component is a search comparator, which is used to
determine the actions of the key according to the state of the flag, where the states
include abandon, search, write, or out-match. The second component is a key matching
engine that is used to store the key and compare the stored key with the search key in a
TCAM array. For wildcard pattern matching, the corresponding key of the accept state
(stored key) will be stored for the next operation, which is the match case of the prefix
state machine. On the other hand, the corresponding key of the accept state in the match
case of the suffix state machine (search key) is used to search the stored key in the
simultaneous matching engine. In Fig. 1(c), if the search result is matched, the wildcard
pattern will be detected. The key feature of this approach is
Fig. 1. Separated TCAM search engines. TCAM array for (a) prefix and (b) suffix state machine. (c)
Search status is decided by simultaneous matching engine.

NXFEE INNOVATION
_________________________________________________________________
Fig. 2. Construct discrete-FA for predefined patterns. (a) Patterns are divided by wildcard (∗). (b) Prefix
state machine. (c) Suffix state machine.
that it uses another small TCAM to process the search results of the prefix state machine
and the suffix state machine to resolve the wildcard-pattern matching problem
The third component is a counting constraints monitor to update the counter of the stored
key according to the state flag. As mentioned earlier, the wildcard of the wildcard pattern
can be replaced by any number of arbitrary characters in the input string. Thus, we define
a counter in the key matching engine to serve as the counting constraints of each stored
key, which limits the lifetime of wildcard patterns that is recognized. The counter of the
stored key which is used to tolerate the characters because of a wildcard during the
process of recognizing the pattern determines the eviction operation for the stored key.
When the counter of the stored key does not equal zero, the counter is decremented for
the counting constraints. If the counter of the stored key equals zero, the engine makes
space for the incoming stored key by evicting this key. The segment ID is used to ensure
that each segment of a multi wildcard pattern is sequentially matched in the input strings.
Single Wildcard Patterns in Discrete-FA
One challenge in recognizing wildcard patterns in TCAM-based search engines is to
identify precisely only one active state with single transition in each search operation that

NXFEE INNOVATION
_________________________________________________________________
negatively affects detecting all possible matches. We know that using more active states
with more state transitions can traverse a greater number of possible matches. It is
impossible to have variable active states to track because of the limitations of hardware
implementation.
Therefore, a hardware search engine is required that can detect all possible situations with
fixed active states to search for wildcard pattern matching. As mentioned before, all
possible matches of a wildcard pattern are generated by a wildcard. However, the
fundamental match condition of wildcard pattern matching is satisfied only if the prefix
and suffix segments of the wildcard patterns are sequentially matched in input strings,
irrespective of the number of characters inserted between the prefix segment and the
suffix segment. On the other hand, we also need to address the possibility of matches
with other predefined patterns in an arbitrary number of characters that are inserted
between the prefix segment and the suffix segment during the process of recognizing the
wildcard pattern.
Based on the above observations, we find that an architecture consisting of two active
states with two state transitions in each search operation is sufficient for accurate
traversal and for detecting two possible ways of match in the regular expression
matching. For constructing state machines in discrete-FA, the predefined patterns, which
consist of wildcard patterns and regular patterns, can be divided into two segments
(prefix and suffix) with a wildcard at the beginning of constructing state machines, as
shown in Fig. 2(a). To increase the complexity of pattern matching, we added two extra
wildcard patterns {hi.∗rs, he.∗e} in the predefined patterns. After the partitioning of
wildcard patterns, a wildcard pattern {sh.∗e} can be transformed to two regular patterns
{sh, e}.
In the original regular patterns {he, his}, all the elements of patterns belong to the prefix
segment because there is no wildcard inside the patterns. On the other hand, the forward

NXFEE INNOVATION
_________________________________________________________________
elements which are partitioned by wildcard {sh, he} are the sub patterns of the prefix
segment. In contrast, the remaining elements of wildcard patterns {e, rs} belong to the
suffix segment in the discrete-FA. Next, two state machines for the prefix segment and
the suffix segment were constructed independently for the proposed architecture, as
shown in Fig. 2(b) and (c). In the discrete-FA, for matching each input character, the
prefix state machine is used to detect the possible matches of the original regular patterns
and the prefix segment of wildcard patterns. On the other hand, the suffix state machine
is used to detect the matches of regular patterns obtained from the suffix segment of
wildcard patterns. Therefore, the match can be traversed in two possible ways in this
matching process. However, the search results of the prefix state machine and the suffix
state machine need to be processed in advance because one of them is not the match in
the wildcard patterns. The process of the key matching will be discussed in more detail in
the following section.
Simultaneous Pattern Matching
To distinguish between the search status of the search operation in discrete-FA, we
defined several new state status such as transition state, relay state, prefix accept state,
and suffix accept state, which serve as the search operation in pattern recognition. During
the state machine construct, each state is marked to a different status, which corresponds
to the nature of the discrete-FA, as illustrated in Fig. 2(b) and (c). In the prefix state
machine, states “6” and “7” are marked to the prefix accept state, which is the pattern
matching state in the regular pattern {her, his}. The relay state, such as states “2,” “4,”
and “5,” is very important in the discrete-FA, which is used to link the prefix segment
and the suffix segment in the wildcard pattern matching process. When the relay state is
reached in the matching process, corresponding actions are activated for wildcard pattern
matching.

NXFEE INNOVATION
_________________________________________________________________
In this phase, the corresponding key (stored key) of the wildcard pattern will be wrote to
the key matching engine for the next phase matching process. Next, in the suffix state
machine, states “2” and “3” are marked to the suffix accept state, which is the pattern
matching state in the wildcard pattern. If the suffix accept state is reached, the
corresponding key (search key) will be used to search the stored key in the key matching
engine. When the search result is matched, the wildcard pattern will be recognized.
Furthermore, the remaining states of the prefix state machine and the suffix state machine
are marked as the transition state, which is only used for state transition. The
corresponding actions of state status and TCAM/memory entries of the discrete-FA in
simultaneous pattern matching are illustrated in Figs. 4 and 5.

NXFEE INNOVATION
_________________________________________________________________
Fig. 4. Data entries for prefix and suffix state machine. (a) TCAM/memory entries for prefix state
machine (b) TCAM/memory entries for suffix state machine.
Fig. 5. Corresponding actions of state status in discrete-FA.
Advantages:
 Space consumption is lower
 Accuracy in recognizing wildcard patterns
 Energy consumption is lower
References:
[1] R. Khan, S. U. Khan, R. Zaheer, and S. Khan, “Future Internet: The Internet of Things architecture,
possible applications and key challenges,” in Proc. ICCSEE, Dec. 2012, pp. 257–260.

NXFEE INNOVATION
_________________________________________________________________
[2] K. Zhao and L. Ge, “A survey on the Internet of Things security,” in Proc. CIS, Dec. 2013, pp. 663–
667.
[3] A. Riahi, Y. Challal, E. Natalizio, Z. Chtourou, and A. Bouabdallah, “A systemic approach for IoT
security,” in Proc. DCOSS, May 2013, pp. 351–355.
[4] H. Ning and H. Liu, “Cyber-physical-social based security architecture for future Internet of
Things,” in Proc. AIT, 2012, pp. 1–7.
[5] Z.-K. Zhang, M. C. Y. Cho, C.-W. Wang, C.-W. Hsu, C.-K. Chen, and S. Shieh, “IoT security:
Ongoing challenges and research opportunities,” in Proc. SOCA, Nov. 2014, pp. 230–234.
[6] S. S. Basu, S. Tripathy, and A. R. Chowdhury, “Design challenges and security issues in the Internet
of Things,” in Proc. TENSYMP, May 2015, pp. 90–93.
[7] A. V. Aho and M. J. Corasick, “Efficient string matching: An aid to bibliographic search,” Commun.
ACM, vol. 18, no. 6, pp. 333–340, Jun. 1975.
[8] J. Van Lunteren, C. Hagleitner, T. Heil, G. Biran, U. Shvadron, and K. Atasu, “Designing a
programmable wire-speed regular-expression matching accelerator,” in Proc. MICRO, Dec. 2012, pp.
461–472.
[9] K. Atasu, “Resource-efficient regular expression matching architecture for text analytics,” in Proc.
ASAP, Jun. 2014, pp. 1–8.
[10] K. Wang, Z. Fu, X. Hu, and J. Li, “Practical regular expression matching free of scalability and
performance barriers,” Comput. Commun., vol. 65, pp. 97–119, Dec. 2016.
[11] N. L. Or, X. Wang, and D. Pao, “MEMORY-based hardware architectures to detect ClamAV virus
signatures with restricted regular expression features,” IEEE Trans. Comput., vol. 65, no. 4, pp. 1225–
1238, Apr. 2016.
[12] C.-J. Cheng, C.-C. Wang, W.-C. Ku, T.-F. Chen, and J.-S. Wang, “A scalable high-performance
virus detection processor against a large pattern set for embedded network security,” IEEE Trans. Very
Large Scale Integr. (VLSI) Syst., vol. 20, no. 5, pp. 841–854, May 2012.

A flexible wildcard pattern matching accelerator via simultaneous discrete finite automata

More Related Content

Similar to A flexible wildcard pattern matching accelerator via simultaneous discrete finite automata (20)

More from Nxfee Innovation (20)

Recently uploaded (20)

A flexible wildcard pattern matching accelerator via simultaneous discrete finite automata