Abstract
Network security has recently become increasingly important. Hence, related technologies like deep packet inspection are being extensively researched and widely implemented. This study proposes a novel scheme and architecture for packet content inspection using graphics processing units (GPUs). The proposed method takes the common component of personal computers, namely GPU, as the accelerator for pattern matching which the critical problem in deep packet inspection. With the native parallel computing power of GPUs, the multiple fragment shaders are considered as parallel pattern matching engines, and with simultaneous pipelines they maximize power of pattern matching. These features are very attractive for content signature recognition which is becoming increasingly popular. Since most network traffic is aggregated from many sessions, the proposed scheme and architecture are particularly designed for processing the multi-session network traffic simultaneously. The well-known automata structure is converted to the data structure executed in GPUs for processing the data flow, which manages the state transition procedure, and the control flow, which is in charge of system I/O, via various graphics processing languages. The proposed scheme and architecture work well with many automaton-based pattern matching algorithms. This study focuses on the most famous one, the Aho and Corasick (AC) algorithm. Besides presenting the scheme in theory and implementing on commodity GPU in practice, this study analyzes the performance of our proposed approach through evaluations, such as showing the memory fingerprint of the automaton in GPU, determining the memory size of all necessary data structures, and analyzing the throughput. The experiment results indicate that, the proposed pattern matching approach can achieve 6.4Gbps throughput powered by the graphics card with the market price less than US$400, representing an improvement on other approaches using accelerator. This study also reveals that the proposed scheme can exploit the resources of the GPU to accelerate the pattern matching processing time, since the GPU installed in common PCs is originally idle at most time periods. The processing time of the proposed software-based implementation is 2/3 less than that of other software-based pattern matching implementations. The proposed concept, Network Processing on Graphics Processing Units, is a novel research field in network processing.