Graphics processing unit (GPU) based method for detecting message content of high-speed network

Abstract

The invention discloses a graphics processing unit (GPU) based method for detecting the message content of a high-speed network to solve the technical problems of reducing the frequency of branch appearance during GPU matching, optimizing the memory access strategies and improving the performance of message content inspection. The technical scheme is as follows: the method comprises the following steps: firstly preprocessing a pattern set and allocating buffer zones, extending a state transfer table of a deterministic finite automaton (DFA) and allocating the buffer zones for the message and the matching result in a central processing unit (CPU) memory and a GPU global memory respectively; secondly loading the message to be matched to a shared memory by the GPU matching thread; and thirdly realizing a GPU-based regular expression matching engine through designing and controlling the regular expression matching engine to carry out pattern matching. By adopting the method, the parallelism of message buffer and message transmission can be improved, the regular expression matching speed is improved and the performances of message buffer and message content inspection are improved.

Description

technical field [0001] The invention relates to the field of network security, in particular to a deep message content detection method for a high-speed network. Background technique [0002] With the diversification of network services and applications, attack methods and intrusion methods emerge in an endless stream, and the network is facing increasingly serious security problems. The network security system implements security early warning and intrusion detection by capturing network traffic and in-depth inspection of message content. The detection of message content is usually to match the payload of the message with a predefined pattern, and pattern matching is the bottleneck of the performance of the entire security system. [0003] As network attacks become more and more complex, the pattern used for message content detection is also replaced by regular expressions with stronger expressive capabilities. The matching process of regular expressions in message...

AI Technical Summary

Problems solved by technology

[0009] 1. The complexity of the DFA state table leads to many branches in the matching process, or multiple tables need to be searched during matching, and the memory access overhead during matching is high, which seriously affects performance;

[0010] 2. The use of GPU memory is not reasonable enough (for example, the GPU message buffer is applied to the texture memory, etc.), which increases the memory access overhead in the matching process

Images