[Y2006]a Scalable Architecture for High-Throughput Regular-Expression Pattern Matching

8/11/2019 [Y2006]a Scalable Architecture for High-Throughput Regular-Expression Pattern Matching

1/26

A Scalable Architecture For High-

Throughput Regular-Expression

Pattern Matching

Authors Benjamin C. Brodie, Ron K.Cytron, David E. Taylor

PresenterYu-Tso Chen

Date September 10, 2007

Publisher ISCA06


2/26

2

Outline

Introduction

Regular expression

Approach and architecture Optimizations

Performance


3/26

3

Introduction

The problem of discovering credit card numbers,

currency values, or telephone numbersrequires a

more general specification mechanism.

For such applications, the most widely used pattern-

specification language is regular expressions.


4/26

4

Introduction

We describe a new high throughput FSMrepresentation andits construction algorithm.

State transitions are triggered by a sequence of msymbols,rather than by a single symbol.

Character and sequence encoding to reduce a transition tablescolumn count, run-length codingto compress the transition

table.


5/26

5

Regular expression

\$[0 - 9]+(\.[0 - 9]{2}){0,1}

A match must begin with $. The match continues only by the appearance of one or more

decimal digits.

Optionally, the match may continue with a decimal pointfollowed by exactly two decimal digits.

EX:

$3, $34, $347, $347.12


6/26

6

FSM exampleRegular expression: \$[0 - 9]+(\.[0 - 9]{2}){0,1}

(a) symbol denotes all symbols not in{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, $, . }

(b) Transition table for the FSM; if is the ASCII character set, then the

table has 256 columns.


7/26

7

Approach

A set of regular expressions is presented to the

Regular Expression Compiler.

Generating three tables: symbol ECI (Equivalence

Class Identifier) table, indirection table, transition table.

The Regular Expression Circuits implement high-

throughput FSMs.


8/26

8

Overall Architecture

Regular Expression Compiler

Regular Expression Circuits


9/26

9

A High-Throughput FSM Modern interconnection interfaces transport multiple bytes per

cycle, making the FSM the bottleneck in terms of achieving

higher throughput.

We consider an extension of the FSM that allows it to performa single transition based on a string of msymbols.

EX:

Based on the table in Figure 2(b), if the current state is E, then

the input sequence 2$would result in a transition to state B:

2

(E, 2$) =

((E, 2), $) = B.


10/26

10

New FSM Because it performs multiple transitions per cycle, the higher

throughput FSM can traverse an accepting state of the originalFSM during a transition.

Each accept may be required to report the origination point of

the match in the target.

To support recognition of accept and restart conditions, weaugment the traditional transition function with two flags(bits):The first flag indicates a restarttransition and the second flag

indicates an accepttransition. (like Moore or Mealy model?)

The automaton includes state variables band eto record thebeginningand endof a match; initially, b =e = 0, and the index ofthe first symbol of the target is 1.


11/26

11

black:e is advanced by m.

A match is in progress and the

portion of the target string

participating thus far begins atposition b and ends at position e,

inclusively.

red only:e is advanced by m and

a match is declared.The target

substring causing the match starts

at position b and ends at position

e.

green only:b is advanced by m

and e is set to b.The automatonis restarting the match process.

red and green:The red action is

performed before the green

action.

Transition on a red edgeindicate a pattern

matchTransition on a green edgeindicates thefirst symbol of a new potential match.


12/26

12

Alphabet Encoding

The size of a FSMs transition table () increasesexponentiallywith the lengthof the input sequenceconsumed in each cycle.

Given a transition table : Q Q, an O(||2|Q|)algorithm for partitioning into a (typically) reduced set ofequivalence classes.

We call the index into the encoded table an ECI(Equivalence class Identifier).

Of the 16 possible two-character input sequences, thetransition table requires only 8columns due to the ECI

mapping.


13/26

13

Example


14/26

14

High-Throughput with Encoding

1. The FSM d is constructed for r (regular expression) in the

usual way.

2. A set of transitions is computed that would allow theautomaton to accept based on starting at anyposition in the

target. This is accomplished by simulating for each state a-

transition to q0. Specifically, is computed as follows:

foreachp Q do

foreach a do

{(p, a) (q0, a)}


15/26

15

High-Throughput with Encoding

3. From d and, the base FSM1is constructed by the algorithm inFigure 8. The results of that algorithm are shown in Figure 5for our running example.

4. State minimization is performed on a high-throughput FSM bythe standard algorithm, except that states are initially split byincoming edge color (black, green, red), instead of by whetherthey are final or nonfinal states in a traditional FSM.

5. Given aFSMk, a higher throughputFSM2kwith alphabetencoding is constructed by the stride-doubling algorithm.


16/26

16

The Symbol ECI Encoding Block

Transforming a sequence of m symbols into an ECI,

suitable for presentation to a transition table.


17/26

17

Transition Table Compression via Run-

Length Coding

Run-length codingis a simple technique that can reduce the storagerequirements for a sequence of symbols

EX:

String: aaaabbbcbbaaaRun-length coding: 4(a)3(b)1(c)2(b)3(a)


18/26

18

Supporting Variable-Length Columns

in Memory

The entire table will typically be too large to be fetched in

one memory access.

Transition Table Memory (TTM)

xis the number of entriesper memory wordin the TTM.

The compressed columns should be placed in physical memory as

compactly as possible.


19/26

19


in Memory

Indirection table

Once the Indirection Table entry is retrieved using the input symbol

ECI, thepointeris used to read the first memory word from the

TTM. An entire column is accessed by starting at address indexand

reading w consecutive wordsfrom the TTM, where w is given by:

Theindex and countvalues determine which entries in the first and

last memory words participate in the column


20/26

20


in Memory


21/26

21


in Memory

State Selection Precompute prefix sums of the compressed entries

The old count value is translated into Word CountandTerminal Indexvalues.

TheInitial Index is used to retrieve a set of mask bits

from theInitial Index Mask ROM. These bits are used

to mask off preceding entries in the memory word that

are not part of the transition table column.

Terminal index = (count + index - 1) mod x


22/26

22


in Memory

The run-length sums for entries that are not part

of the transition table column are forced to the

value of theMax Run-Length Register.

Forcing the run-length sums of trailing entries to be

the maximum run-length sum value simplifies the

Priority Encoder that generates the select bits for themultiplexor that selects the next state.


23/26

23

State select block


24/26

24

Optimizations

Improving the effectiveness of run-length coding

State reordering (knapsack problem)


25/26

25

Optimizations

Memory packing

For example, the compressed column associated with ECI 1 inFigure 11 occupies 3 entries and could fit in a single word of theTTM. However, the column began at a location that caused it tospan 2 memory words instead of 1.

This problem is a variant of the classical fractional knapsackproblem

The basic idea is to find the longest run-lengthencodedcolumn and chose it first. We pack it into memory wordsguaranteeing that it achieves the best possible packing. Wethen take the number of remaining entries in the last columnand apply subset sum on it with the remaining run-length

encoded columns. (greedy)


26/26

26

Performance

Snort(open source)(IPS)(IDS)

Documents

[Y2006]a Scalable Architecture for High-Throughput Regular-Expression Pattern Matching