對深層封包檢測進行字串比對之軟硬體協同設計

Abstract

在病毒掃描與深層封包檢測中，字串比對為系統瓶頸，而目前為了加速字串比對的速度大多以硬體來加速整體輸出量，但是目前大多數的研究都著重在字串比對硬體的加速而忽略了硬體與軟體整合時是否仍然保持高輸出的特性。本論文整合了軟硬體並探討出其中為何系統整合後無法發揮高輸出的特性，並發現基於記憶體的字串比對硬體會因為記憶體搬移時間過長導致無法發揮出硬體高輸出的特性。實驗實作了字串比對BFAST*硬體，此硬體修改自BFAST硬體並使它更容易讓軟體控制，而且與開放原始碼的掃毒套件ClamAV整合後實際在FPGA上計算出輸出量，整合後的掃毒軟體ClamAV輸出量為146.612Mbps比整合前純軟體的ClamAV增加了約27.3倍的速度。而資料從ClamAV搬移至BFAST*的搬移時間佔了字串比對約90%的比重，使得資料搬移時間成為字串比對的瓶頸。如果資料已經在記憶體中，直接使用DMA去記憶體搬移資料進TextRam可以增加輸出量至912.7Mbps，此時的DMA輸出量為1.3Gbps，如果DMA速度能提昇至原來的6倍, ClamAV的輸出量甚至可達到2.176Gbps。

String matching is the bottleneck of anti-virus and deep packet inspection. It is a promising trend to offload the inspection to a specific hardware engine for high-speed applications that demand the throughput up to multi-giga bit rate. Most papers emphasized that raising the throughput of hardware engine but not whole system. This work integrates string matching hardware with ClamAV, and discusses why it can’t stay high throughput when integrating hardware with software. This work also discovers that the data moving time is the bottleneck. The experiment is implementation of string matching hardware BFAST* which make it suitable for software control. We integrate the open source anti-virus package ClamAV with BFAST* and implement on Xilinx FPGA. The experiment includes benchmark the throughput of ClamAV integrated with BFAST*. The throughput of ClamAV with BFAST* is 146.612Mbps and is about 27.3 factors of pure software ClamAV. Time of transferring data from ClamAV to BFAST* occupies about 90% of string matching. If data is well prepared in RAM, we transfer data from RAM to TextRam using DMA, and the throughput of ClamAV is 912.7Mbps. The throughput of DMA is 1.3Gbps. If six times of throughput of DMA is possible, then the throughput of ClamAV is 2.176Gbps.