Pattern matching using Aho-Corasick (AC) algorithm is the most time-consuming task in an Intrusion Detection System, and therefore, the Field Programmable Gate Array (FPGA) based solutions are frequently employed. In this context, the two possibilities are memory based solutions and hardwired solution. The limitation of memory based solutions is the inefficient utilization of slices while the hardwired solutions require a tremendous amount of effort and time as writing Hardware Description Language (HDL) code for thousands of rules is prone to human errors. Consequently, the contributions of this article are twofold. The first contribution is to develop a tool for the automatic generation of Verilog-HDL code from the rule set. The second contribution is to propose an efficient parallel hardware implementation scheme and compare it with a serial hardware implementation scheme in terms of various design parameters such as resource utilization, operational frequency and throughput. The proposed parallel scheme advocates the division of entire rule set into smaller sub-sets for parallel execution. Experimental results reveal that the proposed tool can generate the target code for 10,000 rules in less than a minute without any error. The automatic generation of target code has allowed to perform a comprehensive design space exploration for the parallel implementation of AC algorithm in quick time. Finally, our Xilinx ZC702 evaluation FPGA board based prototype for 10,000 rules can efficiently examine the packet stream coming at a bit rate of 1.56 Gbps at an operational frequency of 195 MHz.

使用 Aho-Corasick (AC) 算法进行模式匹配是入侵检测系统中最耗时的任务，因此，经常采用基于现场可编程门阵列 (FPGA) 的解决方案。在这种情况下，两种可能性是基于内存的解决方案和硬连线解决方案。基于内存的解决方案的局限性在于切片的低效利用，而硬连线解决方案需要大量的精力和时间，因为为数千条规则编写硬件描述语言 (HDL) 代码很容易出现人为错误。因此，本文的贡献是双重的。第一个贡献是开发了一个从规则集中自动生成 Verilog-HDL 代码的工具。第二个贡献是提出了一种高效的并行硬件实现方案，并在资源利用率、运行频率和吞吐量等各种设计参数方面将其与串行硬件实现方案进行了比较。所提出的并行方案提倡将整个规则集划分为较小的子集以并行执行。实验结果表明，所提出的工具可以在不到一分钟的时间内生成 10,000 条规则的目标代码，并且没有任何错误。目标代码的自动生成允许在短时间内对 AC 算法的并行实现进行全面的设计空间探索。最后，我们基于 Xilinx ZC702 评估 FPGA 板的 10,000 条规则原型可以有效地检查以 1 比特率传入的数据包流。