SSE Instruction and Block Predetermination-Based Automaton Optimization

Techniques to decrease the memory requirements of large patterns set for an intrusion detection system (IDS), block predetermination, and block matching based on a self-balancing binary search tree (AVL) are defined in this chapter. By introducing SSE instruction, the new DFA matching system can increase matching efficiency when compared to the standard AC implementation. For illustration, a number of tests, according to different lengths or different amount of patterns were used to show how many DFA states and how much memory can be saved by the design. Empirical results show that at best an SSE-AVL-based implementation of DFA can save about 98 % of memory usage in common DFA when using randomly generated patterns. The hybrid of block DFA and common character DFA can effectively suppress memory requirements, and with the help of block predetermination with two-level-AVL filtration and SSE instruction, the matching speed performs better than standard AC under single process case.