Author : Masanori Bando, N. Sertac Artan and H. JonathanChaoAuthor : Masanori Bando, N. Sertac Artan and H. JonathanChao
Publisher : Parallel & Distributed Processing, Workshopsand Phd Forum (IPDPSW), 2010Publisher : Parallel & Distributed Processing, Workshopsand Phd Forum (IPDPSW), 2010
Presenter : Jo-Ning YuPresenter : Jo-Ning Yu
Date : 2011/05/11Date : 2011/05/11
Example
LaFA Architecture
Correlation Block
Detection Block
Evaluations
2
Outline
Example
3
Detection Block : detect the simple strings and variablestrings in the input string.
Correlation block : correlate detected Events(＊) todetermine whether the input matches any of the RegExes inits RegEx set.
＊The match signal is called an Event in this paper.
LaFA Architecture
4
5
LaFA Architecture
Correlation Block
n = 3
RegEx1 :abc[a-z]op
S1 V1 S2
RegEx4 :abc[^x]{3}xyz
S1 V2 S3
Timing History
6
Node Infomation
7
Correlation Block
8
Buffered Lookup Modules
The modules use previously detected character histories toverify a queried variable string.
Time Lookup Module (TLM)
Contents Lookup Module (CLM)
Frequently appearing Repetition detection Module (FRM)
Short simple string Detection Module (SDM)
In-line Lookup Module
The module processes incoming characters in real time.
Repetition Detection Module(RDM)
Detection Modules
9
TLM detects character classes and negated character classeswith no repetition, ex : [a-z], or [ˆ0-9].
TLM incorporates an input buffer, which stores charactersrecently received from a packet in chronological order.
Ex:
Time Lookup Module(TLM)
10
TLM Architecture
11
CLM detects negated single characters with repetitions,ex : [ˆa]{3}, [ˆa]{3,5}, or [ˆa]{3,}.
CLM stores timestamps of every ASCII character.Thus, 256 memory locations are reserved, each for oneASCII character.
Ex:
Contents Lookup Module(CLM)
12
13
CLM Architecture
C = 8
RDM detects character classes and negated character classes withrepetitions, ex : [a-z]{3}, [a-z]{3,5}, and [a-z]{3,} ( base{min, max} ).
The RDM is the only in-line detection module.
Once number of repetitions reaches to the minimum repetition value,a next simple string is activated. The next simple string inactivatewhen number of repetitions reaches to the maximum repetition value.
Ex:
Repetition Detection Module(RDM)
14
15
RDM Architecture
R = 2
The FRM can detect any type of repetition using abuffered lookup approach.
FRM can be shared among multiple RegExes that helps toimprove resource efficiency.
When the sequence breaks, the count and timestamp arestored in a history memory inside of the FRM.
Frequently Appearing Repetition Detection Module(FRM)
16
17
FRM Architecture
F = 4
We classify strings with less than 5 characters as a shortsimple string.
It naturally generate more Events.
The SDM architecture is very similar to the TLM exceptthat in the SDM, there are multiple memory blocks tosupport multiple character lookups at a clock cycle.
Short Simple String Detection Module(SDM)
18
19
SDM Architecture
＊SSD : Simple String Detector[11]
Evaluations
20
Memory Requirements for the System
21
Evaluations
The design is running at a clock frequency of250MHz, which is equivalent to 2Gbps detectionthroughput per engine.
Xilinx Virtex-6 FPGA contains 32Mbits of blockRAM. Since 17 LaFA engine can fit in the FPGA, weexpect the total throughput can reach to 34Gbps.
22
Evaluations