A Hybrid CPU/GPU Pattern-Matching Algorithm for Deep Packet Inspection

Chun-Liang Lee; Yi-Shan Lin; Yaw-Chung Chen

doi:10.1371/journal.pone.0139301

A Hybrid CPU/GPU Pattern-Matching Algorithm for Deep Packet Inspection

PLoS One. 2015 Oct 5;10(10):e0139301. doi: 10.1371/journal.pone.0139301. eCollection 2015.

Authors

Chun-Liang Lee¹, Yi-Shan Lin², Yaw-Chung Chen²

Affiliations

¹ Department of Computer Science and Information Engineering, School of Electrical and Computer Engineering, College of Engineering, Chang Gung University, Taoyuan, Taiwan.
² Department of Computer Science, National Chiao Tung University, Hsinchu, Taiwan.

Abstract

The large quantities of data now being transferred via high-speed networks have made deep packet inspection indispensable for security purposes. Scalable and low-cost signature-based network intrusion detection systems have been developed for deep packet inspection for various software platforms. Traditional approaches that only involve central processing units (CPUs) are now considered inadequate in terms of inspection speed. Graphic processing units (GPUs) have superior parallel processing power, but transmission bottlenecks can reduce optimal GPU efficiency. In this paper we describe our proposal for a hybrid CPU/GPU pattern-matching algorithm (HPMA) that divides and distributes the packet-inspecting workload between a CPU and GPU. All packets are initially inspected by the CPU and filtered using a simple pre-filtering algorithm, and packets that might contain malicious content are sent to the GPU for further inspection. Test results indicate that in terms of random payload traffic, the matching speed of our proposed algorithm was 3.4 times and 2.7 times faster than those of the AC-CPU and AC-GPU algorithms, respectively. Further, HPMA achieved higher energy efficiency than the other tested algorithms.

Publication types

Research Support, Non-U.S. Gov't

MeSH terms

Algorithms*
Computer Graphics*
Computer Security*
Electronic Data Processing / methods*
Pattern Recognition, Automated / methods*
Software

Grants and funding

This work was supported in part by the High Speed Intelligent Communication (HSIC) Research Center of Chang Gung University, Taiwan, and by grants from the Ministry of Science and Technology of Taiwan (MOST-101-2221-E-009-004-MY3, MOST-102-2221-E-182-034, and MOST-104-2221-E-182-005) and Chang Gung Memorial Hospital (BMRP 942). The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript.