Highly memory-efficient LogLog hash for deep packet inspection

Masanori Bando, N. Sertac Artan, H. Jonathan Chao

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Today's network line rates reach speeds of 40 Gbps and are anticipated to reach 100 Gbps in the near future. These high speeds make Deep Packet Inspection (DPI) in Network Intrusion Detection and Prevention Systems (NIDPSs) very challenging. The DPI examines each incoming packet byte-by- byte and matches them against a set of predefined malicious signatures. One way to achieve high-speed DPI is to store all the signatures on high-speed on-chip memory. However, on-chip memory is limited and space-efficient data structures are needed to leverage precious on-chip memory efficiently. A hash table addressed by a Minimal Perfect Hash Function (MPHF) is such a high-speed, space efficient data structure. In this paper, we describe a highly memory-efficient MPHF, which requires 3.5 bits per key to facilitate access to the key in on-chip memory while allowing us to perform the expensive exact match operation only once. The proposed MPHF also has a low construction time.

Original languageEnglish (US)
Title of host publication2008 IEEE Global Telecommunications Conference, GLOBECOM 2008
Pages2029-2034
Number of pages6
DOIs
StatePublished - 2008
Event2008 IEEE Global Telecommunications Conference, GLOBECOM 2008 - New Orleans, LA, United States
Duration: Nov 30 2008Dec 4 2008

Other

Other2008 IEEE Global Telecommunications Conference, GLOBECOM 2008
CountryUnited States
CityNew Orleans, LA
Period11/30/0812/4/08

Fingerprint

Inspection
Hash functions
Data storage equipment
Data structures
Intrusion detection

ASJC Scopus subject areas

  • Electrical and Electronic Engineering

Cite this

Bando, M., Artan, N. S., & Chao, H. J. (2008). Highly memory-efficient LogLog hash for deep packet inspection. In 2008 IEEE Global Telecommunications Conference, GLOBECOM 2008 (pp. 2029-2034). [4698166] https://doi.org/10.1109/GLOCOM.2008.ECP.391

Highly memory-efficient LogLog hash for deep packet inspection. / Bando, Masanori; Artan, N. Sertac; Chao, H. Jonathan.

2008 IEEE Global Telecommunications Conference, GLOBECOM 2008. 2008. p. 2029-2034 4698166.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Bando, M, Artan, NS & Chao, HJ 2008, Highly memory-efficient LogLog hash for deep packet inspection. in 2008 IEEE Global Telecommunications Conference, GLOBECOM 2008., 4698166, pp. 2029-2034, 2008 IEEE Global Telecommunications Conference, GLOBECOM 2008, New Orleans, LA, United States, 11/30/08. https://doi.org/10.1109/GLOCOM.2008.ECP.391
Bando M, Artan NS, Chao HJ. Highly memory-efficient LogLog hash for deep packet inspection. In 2008 IEEE Global Telecommunications Conference, GLOBECOM 2008. 2008. p. 2029-2034. 4698166 https://doi.org/10.1109/GLOCOM.2008.ECP.391
Bando, Masanori ; Artan, N. Sertac ; Chao, H. Jonathan. / Highly memory-efficient LogLog hash for deep packet inspection. 2008 IEEE Global Telecommunications Conference, GLOBECOM 2008. 2008. pp. 2029-2034
@inproceedings{17ee9523c88840ee923f47c0d884157a,
title = "Highly memory-efficient LogLog hash for deep packet inspection",
abstract = "Today's network line rates reach speeds of 40 Gbps and are anticipated to reach 100 Gbps in the near future. These high speeds make Deep Packet Inspection (DPI) in Network Intrusion Detection and Prevention Systems (NIDPSs) very challenging. The DPI examines each incoming packet byte-by- byte and matches them against a set of predefined malicious signatures. One way to achieve high-speed DPI is to store all the signatures on high-speed on-chip memory. However, on-chip memory is limited and space-efficient data structures are needed to leverage precious on-chip memory efficiently. A hash table addressed by a Minimal Perfect Hash Function (MPHF) is such a high-speed, space efficient data structure. In this paper, we describe a highly memory-efficient MPHF, which requires 3.5 bits per key to facilitate access to the key in on-chip memory while allowing us to perform the expensive exact match operation only once. The proposed MPHF also has a low construction time.",
author = "Masanori Bando and Artan, {N. Sertac} and Chao, {H. Jonathan}",
year = "2008",
doi = "10.1109/GLOCOM.2008.ECP.391",
language = "English (US)",
isbn = "9781424423248",
pages = "2029--2034",
booktitle = "2008 IEEE Global Telecommunications Conference, GLOBECOM 2008",

}

TY - GEN

T1 - Highly memory-efficient LogLog hash for deep packet inspection

AU - Bando, Masanori

AU - Artan, N. Sertac

AU - Chao, H. Jonathan

PY - 2008

Y1 - 2008

N2 - Today's network line rates reach speeds of 40 Gbps and are anticipated to reach 100 Gbps in the near future. These high speeds make Deep Packet Inspection (DPI) in Network Intrusion Detection and Prevention Systems (NIDPSs) very challenging. The DPI examines each incoming packet byte-by- byte and matches them against a set of predefined malicious signatures. One way to achieve high-speed DPI is to store all the signatures on high-speed on-chip memory. However, on-chip memory is limited and space-efficient data structures are needed to leverage precious on-chip memory efficiently. A hash table addressed by a Minimal Perfect Hash Function (MPHF) is such a high-speed, space efficient data structure. In this paper, we describe a highly memory-efficient MPHF, which requires 3.5 bits per key to facilitate access to the key in on-chip memory while allowing us to perform the expensive exact match operation only once. The proposed MPHF also has a low construction time.

AB - Today's network line rates reach speeds of 40 Gbps and are anticipated to reach 100 Gbps in the near future. These high speeds make Deep Packet Inspection (DPI) in Network Intrusion Detection and Prevention Systems (NIDPSs) very challenging. The DPI examines each incoming packet byte-by- byte and matches them against a set of predefined malicious signatures. One way to achieve high-speed DPI is to store all the signatures on high-speed on-chip memory. However, on-chip memory is limited and space-efficient data structures are needed to leverage precious on-chip memory efficiently. A hash table addressed by a Minimal Perfect Hash Function (MPHF) is such a high-speed, space efficient data structure. In this paper, we describe a highly memory-efficient MPHF, which requires 3.5 bits per key to facilitate access to the key in on-chip memory while allowing us to perform the expensive exact match operation only once. The proposed MPHF also has a low construction time.

UR - http://www.scopus.com/inward/record.url?scp=67249156662&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=67249156662&partnerID=8YFLogxK

U2 - 10.1109/GLOCOM.2008.ECP.391

DO - 10.1109/GLOCOM.2008.ECP.391

M3 - Conference contribution

SN - 9781424423248

SP - 2029

EP - 2034

BT - 2008 IEEE Global Telecommunications Conference, GLOBECOM 2008

ER -