Towards Efficient Field Programmable Pattern Matching Array

Pattern matching is used in most of the network security devices in order to detect attacks, threats and malicious network traffic. Many hardware architectures have been designed to accelerate this time-critical operation in order to increase processing speed and achieve multi-gigabit throughput. Recently introduced automata processor is an powerful architecture which represents a new class of field programmable circuits called Field Programmable Pattern Matching Array (FPPMA). In the paper, we propose to improve the FPPMA architecture by Deterministic Units (DU), which have been originally introduced in NFA Split and significantly reduce the amount of required resources for mapping NFA to hardware. Dual position automaton is used to create data structure for the new FPPMA architecture from set of regular expressions. Moreover, we investigate efficiency of DU based on a dual position automation. Since the DU can implement a finite automaton without structural restrictions, we propose to use unrestricted finite automaton for deterministic unit and the dual position automaton for parts mapped to basic FPPMA elements. The results show that the DU based on the unrestricted finite automaton utilizes up to 42.43% less State-Transition elements than the DU based on the dual position automaton. Utilization of DUs provides significant reduction of FPPMA resources. For example, State-transition elements were reduced by more than 71% for the Snort module spyware-put.