SCAMPI a scalable CAM-based algorithm for multiple pattern inspection

• Published in: Proceedings of the Conference on High Performance Computing Networking, Storage and Analysis pp. 1 - 11
• Main Authors: Petrini, Fabrizio, Agarwal, Virat, Pasetto, Davide
• Format: Conference Proceeding
• Language: English
• Published: New York, NY, USA ACM 14.11.2009
• Series: ACM Conferences
• Subjects: Clustering algorithms; Computing methodologies > Machine learning; Dictionaries; Engines; Field programmable gate arrays; Memory management; Multicore processing; Networks > Network services > Network monitoring; Pattern matching; Scalability; Servers; Software algorithms; Theory of computation > Design and analysis of algorithms > Data structures design and analysis > Pattern matching; Theory of computation > Design and analysis of algorithms > Data structures design and analysis > Sorting and searching
• ISBN: 1605587443; 9781605587448
• ISSN: 2167-4329
• DOI: 10.1145/1654059.1654106

String matching is one of the most compute intensive steps in a network intrusion detection system. The growing network rates, rapidly approaching 10 Gbits/sec, and the large number of signatures that need to be scanned concurrently pose very demanding challenges to algorithmic design and practical implementation. In this paper we present SCAMPI, a ground-breaking string searching algorithm that is fast, space-efficient, scalable and resilient to attacks. SCAMPI is designed with a memory-centric model of complexity in mind, to minimize memory traffic and enhance data reuse with a careful compile-time data layout. The experimental evaluation executed on two families of multicore processors, Cell B.E and Intel Xeon E5472, shows that it is possible to obtain a processing rate of more than 2 Gbits/sec per core with very large dictionaries and heavy hitting rates. In the largest tested configuration, SCAMPI reaches 16 Gbits/sec on 8 Xeon cores, reaching, and in some cases exceeding, the performance of special-purpose processors and FPGA. Using SCAMPI we have been able to scan an input stream using a dictionary of 3.5 millions keywords, more than an order of magnitude larger than any published result in the literature and in commercial prototypes, at a rate of more than 1.2 Gbits/sec per processing core.