Lee Chun-Liang, Lin Yi-Shan, Chen Yaw-Chung
Department of Computer Science and Information Engineering, School of Electrical and Computer Engineering, College of Engineering, Chang Gung University, Taoyuan, Taiwan.
Department of Computer Science, National Chiao Tung University, Hsinchu, Taiwan.
PLoS One. 2015 Oct 5;10(10):e0139301. doi: 10.1371/journal.pone.0139301. eCollection 2015.
The large quantities of data now being transferred via high-speed networks have made deep packet inspection indispensable for security purposes. Scalable and low-cost signature-based network intrusion detection systems have been developed for deep packet inspection for various software platforms. Traditional approaches that only involve central processing units (CPUs) are now considered inadequate in terms of inspection speed. Graphic processing units (GPUs) have superior parallel processing power, but transmission bottlenecks can reduce optimal GPU efficiency. In this paper we describe our proposal for a hybrid CPU/GPU pattern-matching algorithm (HPMA) that divides and distributes the packet-inspecting workload between a CPU and GPU. All packets are initially inspected by the CPU and filtered using a simple pre-filtering algorithm, and packets that might contain malicious content are sent to the GPU for further inspection. Test results indicate that in terms of random payload traffic, the matching speed of our proposed algorithm was 3.4 times and 2.7 times faster than those of the AC-CPU and AC-GPU algorithms, respectively. Further, HPMA achieved higher energy efficiency than the other tested algorithms.
如今，通过高速网络传输的大量数据使得深度包检测对于安全目的而言不可或缺。针对各种软件平台，已经开发出了可扩展且低成本的基于特征的网络入侵检测系统用于深度包检测。仅涉及中央处理器（CPU）的传统方法如今在检测速度方面被认为是不够的。图形处理器（GPU）具有卓越的并行处理能力，但传输瓶颈会降低GPU的最佳效率。在本文中，我们描述了一种混合CPU/GPU模式匹配算法（HPMA）的提议，该算法在CPU和GPU之间划分并分配包检测工作负载。所有数据包首先由CPU进行检测，并使用简单的预过滤算法进行过滤，可能包含恶意内容的数据包会被发送到GPU进行进一步检测。测试结果表明，在随机有效负载流量方面，我们提出的算法的匹配速度分别比AC-CPU算法和AC-GPU算法快3.4倍和2.7倍。此外，HPMA比其他测试算法具有更高的能源效率。
