A CAM-based keyword match processor architecture

This paper demonstrates a keyword match processor capable of performing fast dictionary search with approximate match capability. Using a content addressable memory with processor element cells, the processor can process arbitrary sized keywords and match input text streams in a single clock cycle. We present an architecture that allows priority detection of multiple keyword matches on single input strings. The processor is capable of determining approximate match and providing distance information as well. A 64-word design has been developed using 19,000 transistors and it could be expanded to larger sizes easily. Using a modest 0.5 μm process, we are achieving cycle times of 10 ns and the design will scale to smaller feature sizes.

[1]  John W. Lockwood,et al.  Deep packet inspection using parallel Bloom filters , 2003, 11th Symposium on High Performance Interconnects, 2003. Proceedings..

[2]  Karl-Erwin Großpietsch,et al.  Associative processors and memories: a survey , 1992, IEEE Micro.

[3]  Paul Francis,et al.  Fast routing table lookup using CAMs , 1993, IEEE INFOCOM '93 The Conference on Computer Communications, Proceedings.

[4]  William H. Mangione-Smith,et al.  Deep packet filter with dedicated logic and read only memories , 2004, 12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines.

[5]  Viktor K. Prasanna,et al.  A methodology for synthesis of efficient intrusion detection systems on FPGAs , 2004, 12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines.

[6]  K. Hirata,et al.  A 1.2-million transistor, 33-MHz, 20-b dictionary search processor (DISP) ULSI with a 160-kb CAM , 1990 .

[7]  George Varghese,et al.  Fast Content-Based Packet Handling for Intrusion Detection , 2001 .

[8]  A. Cantoni,et al.  Cascading content-addressable memories , 1992, IEEE Micro.

[9]  Dionisios N. Pnevmatikatos,et al.  Pre-decoded CAMs for efficient and high-speed NIDS pattern matching , 2004, 12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines.

[10]  M. Hirata,et al.  A versatile data string-search VLSI , 1988 .

[11]  Brad L. Hutchings,et al.  Assisting network intrusion detection with reconfigurable hardware , 2002, Proceedings. 10th Annual IEEE Symposium on Field-Programmable Custom Computing Machines.

[12]  Rina Panigrahy,et al.  Sorting and Searching using Ternary CAMs , 2003, IEEE Micro.

[13]  C.J. Coit,et al.  Towards faster string matching for intrusion detection or exceeding the speed of Snort , 2001, Proceedings DARPA Information Survivability Conference and Exposition II. DISCEX'01.

[14]  Robert S. Boyer,et al.  A fast string searching algorithm , 1977, CACM.

[15]  T. Enomoto,et al.  A 2 K-word dictionary search processor (DISP) LSI with an approximate word search capability , 1992 .

[16]  C. G. Sodini,et al.  A ternary content addressable search engine , 1989 .

[17]  Evangelos P. Markatos,et al.  : A DOMAIN-SPECIFIC STRING MATCHING ALGORITHM FOR INTRUSION DETECTION , 2003 .

[18]  Philip Heng Wai Leong,et al.  A Smith-Waterman Systolic Cell , 2003, FPL.

[19]  Peter M. Athanas,et al.  A run-time reconfigurable system for gene-sequence searching , 2003, 16th International Conference on VLSI Design, 2003. Proceedings..

[20]  Kei Hiraki,et al.  Over 10Gbps String Matching Mechanism for Multi-stream Packet Scanning Systems , 2004, FPL.

[21]  Donald E. Knuth,et al.  Fast Pattern Matching in Strings , 1977, SIAM J. Comput..

[22]  Alfred V. Aho,et al.  Efficient string matching , 1975, Commun. ACM.