String matching serves as a critical module for network security systems. To meet escalating network bandwidth demands, recent studies have transitioned to hardware platforms like FPGA, leveraging the parallel processing ability to accelerate string matching. However, existing hardware solutions face a critical challenge in parallel matching of variable-length string patterns. They require length-specific memory blocks, such as separate hash tables to store patterns of different lengths. This distributed memory architecture causes a memory fragmentation issue when patterns are unevenly distributed, which impacts the scalability of prior works. To address the memory fragmentation issue of the distributed memory architecture, this paper proposes (1) a unified memory architecture that enables unified storage of variable-length patterns, and (2) a collision-free hash scheme that supports parallel matching of variable-length strings in the architecture. We implemented the proposed memory-efficient scheme on an FPGA-based prototype. Extensive evaluations demonstrate that the unified memory architecture achieves 4-5× lower memory usage compared to state-of-the-art alternatives while achieving comparable throughput. Meanwhile, the architecture can store patterns across arbitrary length distributions within a specified length range until its maximum capacity.

Packet Classification is a key part of supporting lots of network functions. Various algorithms have been proposed over the years to meet the increasing performance requirements of packet classification. Tuple space search (TSS) is one of the most popular algorithms and well-suited to scenarios requiring efficient online updates. However, the huge number of tuples in the algorithm leads to numerous memory accesses during packet classification, which limits the classification performance. This paper proposes a novel model named FATSS, which uses Filters to Assist the Tuple Space Search algorithm and reduces the number of tuple accesses. We first create the ImCuckoo Filter by improving the Cuckoo Filter from its structure, capacity and hash calculation. Then, we embed ImCuckoo Filter into TSS in two ways (online and offline) to adapt to diverse scenarios and requirements. By the experiments, it can be found that the ImCuckoo Filter can reduce more than 80% of tuple accesses. Furthermore, the access time of the filter is no more than 60% compared with that of the hash table. The experimental results show that the classification time of FATSS is 17%–19% faster than that of existing widely used algorithms.

Packet classification shows a key role in kinds of network functions, such as access control, routing, and quality of service (QoS). With the rapid growth of the network size, users have to ignore some fields in packet classification due to resource constraints. In addition, some fields may not always be available in some networks. However, traditional packet classification algorithms can hardly handle packet classification if some fields are missing. In this paper, we propose a novel model to build a robust classifier. In the classifier, we utilize the advantage of Recursive Flow Classification (RFC) in handling fields concurrently. Then, we design a new workflow to deal with field missing based on flows. In addition, two complementary bitmap models are designed to accelerate matching packets to flows, and a buffer mechanism is introduced to further improve the classification accuracy. Our experiments show that the proposed classifier can classify packets with an accuracy of 94%-99.5% when the field missing probability is lower than 0.3.

Packet classification shows an essential role in net-work functions. Traditional classification algorithms assume that all field values are available and valid. However, such a premise is being challenged as networks become more complex now. Scenarios with field-missing poses great challenges to packet classifiers. Existing approaches can only list all possible situations in such cases, increasing the workload exponentially. RFC algorithm is proved to be helpful for this issue in our previous work, but its spacial performance is much poor. In this paper, we propose a novel classification scheme using Tuple Space Search (TSS) to deal with missing fields. We redesign the hash calculation method and raise a new data structure to recover field-missing packets. The experiment shows that RTSS reduce the memory consumption and construction time by several orders of magnitude. At the same time, RTSS has better classification performance than previous work, while supporting fast updates.

In the last decades, Wireless Local Area Network (WLAN) has been emerging as one of the most prevailing networking architectures. It is expected that current WLAN technologies will further evolve to obtain much higher performance, more energy efficiency and more robustness. However, the WLAN is still prone to a variety of attacks regardless of the existence of data protection and security association mechanisms. They include but not limited to dictionary attacks against the pre-shared secret key of Wi-Fi Protected Access (WPA)/WPA2, the key reinstallation attack (KRACK) against the handshake procedure of WPA2, etc. Although a brand new WPA3 has been recently standardized by Wi-Fi Alliance to address new security threats, it needs a long time to upgrade currently used access points. Hence, there is a significant gap between security and deployment cost. To fill this gap, we design and implement an intellignet WLAN Early warning Platform (iWEP) to provide an early warning service for clients. Specifically, iWEP adopts intelligence algorithms, e.g., machine learning, to provide the capability of defeating existing popular attacks, including Wired Equivalent Privacy (WEP) secret cracking, WPA/WPA2 dictionary attack, Denial-of-Service and KRACK, by handling behaviour features that are extracted from the compromising procedures in real experimental environments. Moreover, iWEP uses edge computing technology to make a good tradeoff between system performance and WLAN security. Finally, we implement a prototype system of iWEP, and the real results demonstrate its effectiveness.