A novel hierarchical parallelism for accelerating NIDS using GPUs

Multi-string matching has been widely used in network intrusion detection systems to detect network attacks and malicious network packets by matching packet contents with thousands of attack patterns. Due to the rapid increase of network attacks and network speeds, multi-string matching faces higher performance and throughput challenges. In order to improve the performance and throughput of multi-string matching, this paper presents a hierarchical parallelism that accelerates multi-string matching on multiple GPUs. The hierarchical parallelism consists of three layers of parallelism. From top to bottom, the first layer is the data parallelism on multiple GPUs, the second layer is the task parallelism on a single GPU, and the last layer is the data parallelism of the Aho-Corasick algorithm. Experimental results show that the hierarchical parallelism on a machine featured with four Titan X GPUs achieves up to 70 Gbps of throughput, more than 40 times faster than the Aho-Corasick algorithm used in Snort. As the number of GPUs increases, the throughput of the hierarchical parallelism will increase. In addition, the proposed approach adopts perfect hashing to construct state machines and achieves up to 99.2% of memory reduction on Snort. Finally, the proposed hierarchical parallelism is implemented in the open source network intrusion detection system, Snort.