Bouma2 - A Quasi-Stateless, Tunable Multiple String-Match Algorithm

Erez M. Buchnik

The Bouma2 algorithm attempts to challenge the prevalent "stateful" exact string-match paradigms by suggesting a "quasi-stateless" approach. We claim that using state-machines to solve the multiple exact string-match problem introduces a hidden artificial constraint, namely the Consume-Order Dependency, which results in unnecessary overhead. Bouma2 is not restricted in this sense; we postulate that this allows memory-efficiency and improved performance versus its state-machine equivalents. The heart of the Bouma2 preprocessing problem is formulated as a weighted Integer Linear Programming problem, that can be tuned for memory footprint and performance optimization. Specifically, this allows Bouma2 to be input-sensitive, as tuning can be based on input characteristics. Evaluating Bouma2 against the Aho-Corasick variant of the popular Snort Intrusion Prevention System, we demonstrate double the throughput while using about 10% of the memory.

Knowledge Graph

arrow_drop_up

Comments

Sign up or login to leave a comment