Bloom filters are frequently used to identify malicious content like viruses in high speed networks. However, architectures proposed to implement Bloom filters are not power efficient. In this letter, we propose a new Bloom filter architecture that exploits the well-known pipelining technique. Through power analysis we show that pipelining can reduce the power consumption of Bloom filters up to 90%, which leads to the energy-efficient implementation of intrusion detection systems. © 2006 IEEE

Kaya, I

Kocak, T

English

Bloom filters are frequently used to identify malicious content like viruses in high speed networks. However, architectures proposed to implement bloom filters are not power efficient. In this letter, we propose a new bloom filter architecture that exploits the well-known pipelining technique. Through power analysis we show that pipelining can reduce the power consumption of bloom filters up to 90%, which leads to the energy-efficient implementation of intrusion detection systems

Explore Bristol Research

                          Kocak, T., & Kaya, I. (2006). Low-power bloom filter architecture for deeppacket inspection. IEEE Communications Letters, 10(3), 210 - 212.10.1109/LCOMM.2006.03028, 10.1109/LCOMM.2006.1603387Link to published version (if available):10.1109/LCOMM.2006.0302810.1109/LCOMM.2006.1603387Link to publication record in Explore Bristol ResearchPDF-documentUniversity of Bristol - Explore Bristol ResearchGeneral rightsThis document is made available in accordance with publisher policies. Please cite only the publishedversion using the reference above. Full terms of use are available:http://www.bristol.ac.uk/pure/about/ebr-terms.htmlTake down policyExplore Bristol Research is a digital archive and the intention is that deposited content should not beremoved. However, if you believe that this version of the work breaches copyright law please contactopen-access@bristol.ac.uk and include the following information in your message:• Your contact details• Bibliographic details for the item, including a URL• An outline of the nature of the complaintOn receipt of your message the Open Access Team will immediately investigate your claim, make aninitial judgement of the validity of the claim and, where appropriate, withdraw the item in questionfrom public view.210 IEEE COMMUNICATIONS LETTERS, VOL. 10, NO. 3, MARCH 2006Low-Power Bloom Filter Architecture forDeep Packet InspectionTaskin Kocak and Ilhan KayaAbstract— Bloom filters are frequently used to identify ma-licious content like viruses in high speed networks. However,architectures proposed to implement Bloom filters are not powerefficient. In this letter, we propose a new Bloom filter architecturethat exploits the well-known pipelining technique. Throughpower analysis we show that pipelining can reduce the powerconsumption of Bloom filters up to 90%, which leads to theenergy-efficient implementation of intrusion detection systems.Index Terms— Bloom filters, low-power design, network intru-sion detection.I. INTRODUCTIONNETWORK intrusion detection systems (NIDS) are usedto identify the malicious content such as internet wormsand viruses in network packets. They typically employ a deeppacket inspection functionality, which checks the payload ofthe packet against a set of known virus and worm signatures.Bloom filters [1] are used in such filtering applications tomatch strings such as Snort rules [7]. Although Bloom filtershave found wide spread usage in networking applications [2],they are not conservative in terms of power. An NIDS consistsof 4 Bloom filter engines can dissipate up to 5 W. In order toreduce the power consumption of Bloom filters, we proposeto employ a pipelining technique in the architecture of Bloomfilters. We call this new type of Bloom filters as pipelinedBloom filters. In this letter, first, we propose a hardwaresystem consists of pipelined Bloom filters as an energy-efficient NIDS. Then, we provide a mathematical analysis toshow that the proposed system is more energy-efficient thanthe regular Bloom filter-based architectures used so far.II. BLOOM FILTERSA Bloom filter is a data structure that stores a given set ofsignatures, by first computing multiple hash functions on eachof the members of the set, and then it queries the database for agiven input string, by again computing many hash functions ofthe input with a lookup operation followed over the database.First operation is called programming of the Bloom filter, andthe second operation is querying. A typical Bloom filter isillustrated in Fig. 1.In the programming stage, given a string X, which is amember of the signature set, a Bloom filter computes k manyhash values on the input X by using k different hash functions.Manuscript received September 29, 2005. The associate editor coordinatingthe review of this letter and approving it for publication was Prof. IakovosVenieris.The authors are with the School of Electrical Engineering and ComputerScience, University of Central Florida, Orlando, FL 32816 USA (e-mail:{tkocak, ikaya}@cs.ucf.edu).Digital Object Identifier 10.1109/LCOMM.2006.03028.Fig. 1. A regular Bloom filter with k hash functions.Then it uses these hash values as index to the m-bit longlookup vector. It sets the bits corresponding to the index givenby the hash values computed. It repeats this procedure for eachmember of the signature set.In the query stage, for an input string Y, Bloom filtercomputes k many hash values by utilizing the same hashfunctions used in programming of the Bloom filter. Bloomfilter looks up the bit values located on the offsets (computedhash values) on the bit vector, and,* If it finds any bit unset at those addresses, it declaresthe input string to be a nonmember of the signature set,which is called a mismatch.* Otherwise, it finds all the bits are set, it concludes thatinput string may be a member of the signature set witha certain probability (false positive probability), which iscalled a match.A Bloom filter never produces false negatives, which meansif it decides that an input is a nonmember, input certainly doesnot belong to the signature set. However, it may produce falsepositives.Following the analysis of [4], the false positive probabilityf is calculated by,f =(1− e−nkm)k(1)where n is the number of signatures programmed into theBloom filter, m is the length of the lookup vector, and k is thenumber of hash functions used to implement the Bloom filter.In order to minimize the false positive probability, the valueof m must be quite larger than n. For a fixed value of mn , kmust be large enough such that f gets minimized. The numberof hash functions that minimizes the false positive probability1089-7798/06$20.00 c© 2006 IEEEKOCAK and KAYA: LOW-POWER BLOOM FILTER ARCHITECTURE FOR DEEP PACKET INSPECTION 211is given byk =(mn)ln 2 (2)If we take the average number of bits allocated to a singlesignature, mn = 50 , the number of hash functions per Bloomfilter is calculated ask = (m/n) ln 2, k = (50) ln 2, k = 35 (3)Substituting mn = 50 , and k = 35 into the false positiveprobability equation, Equ. 1, yields a small probability withwhich Bloom filter produces false positives.f = 0.535 < 3.10−11 (4)Hash functions used in the Bloom filters are generally of typeuniversal hash functions [3]. The performance of universalhash functions are explored by Ramakrishna et al [6]. The hashfunction, being a member of a universal hash function class,maps the input string to an output string, such that collisionprobability of given any two input strings is small. Given anystring X, consisting of b bits,X =< x1, x2, x3...xb > (5)ith hash function over the string X is defined ashi(x) = ri1 • x1 ⊕ ri2 • x2 ⊕ ri3 • x3 ⊕ ...rib • xb (6)where rij’s are random coefficients ranging from 1 to m, andxi’s are the bits in the input string.A single Bloom filter uses k many hash functions in order tomake a decision on the input. Hence the power consumption ofa Bloom filter shown in Fig. 1 is a summation of the powerconsumptions of each of the hash functions, PHi , with thelookup operation, PL, followed, plus an AND operation:PBFregular =k∑i=1(PHi + PL) + PAND (7)Power consumption of the AND gate is ignored hereafter,since it is minimal compared to the power used by the hashfunctions. We also assume that the lookup power over a m-bit vector is approximately constant for each index calculatedby any of the hash functions. Since hash functions with thesame number of input bits will be implemented with the samenumber of components and will consume approximately thesame amount of power. We can write the power consumptionof a regular Bloom filter as followsPBFregular =k∑i=1(PHi + PL) = k.(PH + PL) (8)III. PIPELINED BLOOM FILTERSSince the number of hash functions required to minimizethe false positive probability of a Bloom filter is large, it isbetter, in terms of power, to implement these hash functionsin a pipelined manner. We call this new type of Bloom filterspipelined Bloom filters.Basically, a pipelined Bloom filter, as shown in Fig. 2,consists of two groups of hash functions. The first stage alwayscomputes the hash values. By contrast, the second stage ofhash functions only compute the hash values if in the firstFig. 2. A 2-stage pipelined Bloom filter.stage there is a match between the input and the signaturesought.The pipelined Bloom filters will have the same number ofhash functions as the regular Bloom filters. Hence the falsepositive probability is the same. A pipelined Bloom filterexploits the virus free nature of the network traffic in most ofthe time. At worst, it will operate like a regular Bloom filter,which uses all of the hash functions before making a decisionon the type of the input. The advantage of using a pipelinedBloom filter is if the first stage produces a mismatch, there isno need to use the second stage in order to decide whether theinput string is a member of the signature set. This is simplybecause a Bloom filter never produces a false negative.Let us first derive the probability of match in the first stage.By following a similar analysis of [5], we assume that thehash functions used in each Bloom filter are perfectly random.This is a reasonable assumption since each hash functioncoefficients are selected randomly in range 1 to m. In thefirst stage, r-many of the hash functions are utilized. Theprobability that a bit is still unset after all the signatures areprogrammed into the pipelined Bloom filter by using k-manyindependent hash functions is α.α =(1− 1m)kn≈ e−knm (for largem) (9)where 1m represents any one of the m bits set by a singlehash function operating on a single signature. Then(1− 1m)is the probability that the bit is unset after a single hash valuecomputation with a single signature. For it to remain unset, itshould not be set by any of the k-many hash functions eachoperating on all of the n-many signatures in the signature set.Consequently, the probability that any one of the bits is set is(1− α) ≈ 1− e−knm (10)In order for the first stage to produce a match, the bitsindexed by all r of the independent random hash functionsshould be set. So the match probability of the first stage is,represented as p,p =r∏i=1(1− α) =(1− α)r ≈ (1− e−knm )r (11)212 IEEE COMMUNICATIONS LETTERS, VOL. 10, NO. 3, MARCH 20060 10 20 30 40 50 60 7000.10.20.30.40.50.60.70.80.91Number of hash functions in the first stage of pipelined Bloom filters, rPower Saving Ratio, PSRm/n=50m/n=100m/n=25Fig. 3. Power saving ratio in pipelined Bloom filters w.r.t. number of hashfunctions utilized in the first stage.The mismatch probability of the first stage is simply 1-p,1− (1− e−knm )r (12)With a probability of (1-p) the first stage of the hash func-tions in the pipelined Bloom filter will produce a mismatch.Otherwise, the first stage produces a match, then the secondstage is used to compare the input with the signature sought.Therefore the power consumption of a pipelined Bloom filteris given byPBFpipeline = P1st−stage + P{match} × P2nd−stagePBFpipeline =r∑i=1(PHi + PL) + p×k∑j=r+1(PHj + PL)+PAND (13)Again, PAND can be neglected, since it is very small withrespect to the power consumption of hash functions. Thepower consumption of a pipelined Bloom filter simplifies toPBFpipeline =r∑i=1(PHi + PL)+(1− e−knm )r ×k∑j=r+1(PHj + PL)= r.(PH + PL) +(1− e−knm )r(k − r)(PH + PL) (14)The power saving ratio, PSR, in a single Bloom filter bydeploying pipelining technique can be calculated asPSR =(Pregular − Ppipelined)Pregular(15)By substituting Equ. 8 and Equ. 14 into Equ. 15, the averagepower saving ratio, PSR, is given byPSR =(k ×A−[r + (1− e−knm )r × (k − r)]×A)k ×A (16)where A = (PH + PL), which is the power consumption ofa single hash function with a single lookup operation. Aftersimplifying As, average power saving ratio, PSR, is found outto bePSR =k − r + (r − k) (1− e−knm )rk(17)For different values of the number of bits allocated to persignature, mn , power savings over the number of hash functionsutilized in the first stage are illustrated in Fig. 3.The amount of power conserved in the system increases asmn increases. This is because the number of hash functionsdeployed in the first stage becomes a smaller portion of theoverall hash functions deployed in each configuration. Theincrease in the PSR value at first stems from the fact thatincreasing the number of hash functions in the first stageincreases the probability of mismatch, thus the second stage isnot utilized. After the optimum value, PSR decreases steadily.This is again because, the more hash functions are deployedin the first stage, the more power that they consume. If weincrease the number of hash functions used in the first stageto such a degree that all hash functions in the system deployedin the first stage, there remains no power gain at all (i.e., thesystem behaves just like a regular Bloom filter.)IV. CONCLUSIONIn this paper, we exploited the fact that the most of thecurrent network traffic is not malicious and proposed topipeline the hash functions in the Bloom filters that are used innetwork intrusion detection systems. Analytical results showthat the pipelining technique significantly decreases the totalpower consumption of a Bloom filter. It is shown that thelesser the number of hash functions implemented in the fiststage of a pipelined Bloom filter, the more the power savingis. The number of bits allocated to per signature, mn , affectsthe power saving ratio in a pipelined Bloom filter. Analysisperformed for feasible values of mn revealed up to 90% powersavings. The selection of the hash functions to be deployed inthe first stage of a pipelined Bloom filter is not considered inthe current analysis. Our future work will include this as wellas experimental evaluation of these novel pipelined Bloomfilter architectures.REFERENCES[1] B. Bloom, “Space/ time trade-offs in hash coding with allowableerrors,” Commun. ACM, vol. 13, no. 7, pp. 422-426, July 1970.[2] A. Broder and M. Mitzenmacher, “Network applications of bloomfilters: a survey,” Internet Mathematics, vol. 1, no. 4, pp. 485-509,July 2003.[3] J. L. Carter and M. Wegman, “Universal classes of hash functions,”J. Computer and System Sciences, vol. 18, no. 2, pp. 143-154, Apr.1979.[4] S. Dharmapurikar, P. Krishnamurthy, T. S. Sproull, and J. W. Lock-wood, “Deep packet inspection using parallel bloom filters,” IEEEMicro, vol. 24, no. 1, pp. 52-61, Jan. 2004.[5] M. Mitzenmacher, “Compressed bloom filters,” IEEE/ACM Trans.Networking, vol. 10, no. 5, pp. 604-612, Oct. 2002.[6] M. Ramakrishna, E. Fu, and E. Bahcekapili, “Efficient hardwarehashing functions for high performance computers,” IEEE Trans.Computers, vol. 46, no. 12, pp. 1378-1381, Dec. 1997.[7] The Sourcefire Vulnerability Research Team, “Official SnortRuleset,” Sourcefire, Inc., Columbia, MD, Aug. 2005 (web:http://www.snort.org/pub-bin/downloads.cgi).

Compressed bloom ﬁlters,”

Deep packet inspection using parallel bloom ﬁlters,”

Efﬁcient hardware hashing functions for high performance computers,”

Network applications of bloom ﬁlters: a survey,”

Space/ time trade-offs in hash coding with allowable errors,”

The Sourceﬁre Vulnerability Research Team, “Ofﬁcial Snort Ruleset,” Sourceﬁre,

Universal classes of hash functions,”

Low-power bloom filter architecture for deep packet inspection

Kocak, Taskin

Kaya, Ilhan

University of Central Florida (UCF): STARS (Showcase of Text, Archives, Research & Scholarship)

Low-Power Bloom Filter Architecture For Deep Packet Inspection

https://research-information.bris.ac.uk/files/3007360/kocak_CommsLets.pdf

Low-power bloom filter architecture for deep packet inspection

Abstract

Similar works

Full text

Available Versions

Explore Bristol Research

University of Central Florida (UCF): STARS (Showcase of Text, Archives, Research & Scholarship)