High-Speed Pattern Matching Algorithm with CPU/GPU Cooperation for Network Intrusion Detection Systems

Abstract

Network intrusion detection systems (NIDSs) have been widely deployed in the Internet to protect Internet-enabled devices from malicious attacks by performing deep packet inspection (DPI). Pattern matching plays an important role in DPI, and consumes a significant portion of system execution time for NIDSs. In this paper, we propose a high-speed pattern matching algorithm with CPU/GPU cooperation. Incoming packets are first inspected by CPU to quickly filter out suspicious packets that may contain malicious patterns. Then GPU, which has superior parallel computing power, takes over to determine if a suspicious packet does contain malicious patterns. In addition, in our proposed algorithm, GPU does not have to inspect the entire payload of a packet, but instead can bypass the partial packet payload that has been inspected by CPU. Through the cooperation between CPU and GPU, our proposed algorithm can achieve higher pattern mating speeds than other algorithms. Simulation results show that even in the case that all packets contain malicious patterns, our proposed algorithm can achieve a matching speed of 15 Gbps.