一种基于CPU-GPU协同的特征码匹配机制

摘要

In network security system, a signature matching mechanism based on the cooperation of CPU and GPU is proposed. Firstly, a small DFA(deterministic finite automaton) is constructed by using the first n prefix of each rule expression. Secondly, the non-exact matching is done on the GPU to pick out the dubious packets. Lastly, the exact matching is done by CPU. Experimental results show that the matching throughput reaches 19 Gbits/s.%在网络安全系统中,提出了一种基于CPU-GPU协同的特征码匹配机制.先用每个特征码表达式的n前缀,构建一个小的DFA(有限自动机)；再在GPU上进行不完全匹配,剔除大量正常数据包,检测出可疑的数据包；然后再在CPU上对可疑数据包进行精确匹配.测试结果表明,该机制的匹配吞吐量能达到了19 Gbits/s.