Abstract Decision tree (DT)-based machine learning (ML) algorithms are one of the preferred solutions for real-time internet traffic classification in terms of their easy implementation on hardware. However, the rapid increase in today’s newly developed applications and the resulting diversity in internet traffic greatly increases the size of DTs. Therefore, the tree-based hardware classifiers cannot keep up with this growth in terms of resource usage and classification speed. To alleviate the problem, we propose to group application classes by certain rules and create an individual small DT per each group. In this article, a pipelined organization of multiple DT data structures, called pipelined decision trees, is proposed as a scalable solution to tree-based traffic classification. We also propose two distinct algorithms, namely confusion matrix-based class aggregation and leaf count-based class aggregation algorithms, to set group creation rules that allows traffic classification on pipelined smaller DTs in a hierarchical order. We further designed an hardware engine on field programmable gate arrays, which can search those pipelined trees within a single clock cycle by transforming them into bit vectors and implementing multiple range comparisons in parallel. Our architecture with 12 classes can run in 928.88 giga bit per second and achieve 96.04% accuracy.

Traffic classification process categorizes internet traffic into application classes by exploiting packet header data or collected packet statistics. Real-time internet traffic classification is mostly required for network management and security applications. Machine Learning (ML) based traffic classification approaches which utilize statistical properties of traffic flows, have recently attracted great deal of attention from the researches due to its operability under encrypted traffic conditions. In this paper, we propose to use Simple Classification and Regression Trees Forest (SCF) for internet traffic classification. Our proposed scheme comprising multiple parallel trees demonstrates a substantial improvement in search delay and throughput as well as in the memory footprint when compared to a traditional single Simple CART structure. To reach high data rates for realtime classification, we also proposed a parallel and pipelined architecture on Field Programmable Gate Arrays (FPGAs) that support SCF data structure. The post place-and-route FPGA results demonstrate that our design can sustain 854 Gbps or 2669 million classification per second (MCPS) for the minimum packet size of 40 Bytes. Furthermore, our architecture shows an accuracy of 96.6719% for real internet traffic with eight application classes.

Dynamically updateable and memory-efficient search structures for Internet protocol (IP) lookup have lately attracted a great deal of attention from the researchers. In this paper, we focus on the next-generation IPv6 routing protocol comprising large and sparsely distributed routing tables. The existing data structures either suffer from inefficient resource and memory usage (trie-based algorithms), or require complicated construction processes such as converting routing prefixes into their longer representatives and sorting (tree-based algorithms), or both. We propose a novel data structure denoted value-coded trie (VC-trie) for IP lookup. VC-trie provides significant memory saving in comparison with that of the existing solutions in both IPv4 and IPv6 domains. Thereby, our structure can support longer prefix lengths and larger routing tables. We also design an static random access memory (SRAM)-based pipelined architecture to assist the VC-trie structure to improve the throughput. The architecture is implemented utilizing a state-of-the-art field programmable gate array (FPGA) device and sustainable throughput of 448 million lookups per second (with a routing table consisting of 324 K prefixes) is achieved. Furthermore, the architecture can be enhanced with external SRAMs to relax the limitations of the existing FPGA device in on-chip memory.

High-speed IP lookup remains a challenging problem in next generation routers due to the ever increasing line rate and routing table size. In addition, the evolution towards IPv6 also requires long prefix length, sparse prefix distribution, and potentially very large routing tables. In this paper, we propose a novel Combined Length-Infix Pipelined Search (CLIPS) architecture for IPv6 routing table lookup on FPGA. CLIPS solves the longest prefix match (LPM) problem by combining both prefix length and infix pattern search. Binary search in prefix length is performed on the 64-bit routing prefix of IPv6 down to an 8-bit length range in log(64/8)=3 phases; each phase performs a fully-pipelined infix pattern search with only one external memory access. A fourth and the last phase then finds the LPM (if any) within the 8-bit length range in a compressed multi-bit trie.

Hierarchical search structures for packet classification offer good memory performance and support quick rule updates when implemented on multi-core network processors. However, pipelined hardware implementation of these algorithms has two disadvantages: (1) backtracking which requires stalling the pipeline and (2) inefficient memory usage due to variation in the size of the trie nodes. We propose a clustering algorithm that can partition a given rule database into a fixed number of clusters to eliminate back-tracking in the state-of-the-art hierarchical search structures. Furthermore, we develop a novel ternary trie data structure (T∈). In T∈structure, the size of the trie nodes is fixed by utilizing ∈-branch property, which overcomes the memory inefficiency problems in the pipelined hardware implementation of hierarchical search structures. We design a two-stage hierarchical search structure consisting of binary search trees in Stage 1, and T∈structures in Stage 2. Our approach demonstrates a substantial reduction in the memory footprint compared with that of the state-of-the-art. For all publicly available databases, the achieved memory efficiency is between 10.37 and 22.81 bytes of memory per rule. State-of-the-art designs can only achieve the memory efficiency of over 23 byte/rule in the best case. We also propose a SRAM-based linear pipelined architecture for packet classification that achieves high throughput. Using a state-of-the-art FPGA, the proposed design can sustain a 418 million packets per second throughput or 134 Gbps (for the minimum packet size of 40 Bytes). Additionally, our design maintains packet input order and supports in-place non-blocking rule updates.

This paper proposes a novel high throughput internet protocol (IP) lookup engine, which is built upon a recently proposed multiple pipeline array architecture that has parallel two-dimensional circular search capabilities on intersecting and variable length pipelines. Our new engine is composed of specially designed processing elements (PEs) including dual input/output static random access memory units and bidirectional links, hence allowing search to proceed in all directions and admitting search requests from all PEs at the boundary of the array. We propose a novel data structure called compact clustered trie (CCT), which is better than traditional binary trie in terms of memory requirement and number of memory accesses. We develop novel approaches including a CCT forwarding table construction method, a mapping strategy and a suitable IP lookup algorithm. Our new lookup engine achieves a much higher average case throughput and a much lower average delay compared with existing IP lookup solutions making, for example, an 8 Tbps high-speed router front end possible. The engine is also well suited for the IPv6 addressing scheme.

Network router virtualization has recently gained much interest in the research community, as it allows multiple virtual router instances to run on a common physical router platform. The key metrics in designing network virtual routers are (1) number of supported virtual router instances, (2) total number of prefixes, and (3) ability to quickly update the virtual table. Existing merging algorithms use leaf pushing and a shared next hop data structure to eliminate the large memory bandwidth requirement. However, the size of the shared next hop table grows linearly with the number of virtual routers. Due to the limited amount of on-chip memory and the number of I/O pins of Field Programmable Gate Arrays (FPGAs), existing designs cannot support large number of tables and/or large number of prefixes. This paper exploits the abundant parallelism and on-chip memory bandwidth available in the state-of-the-art FPGAs, and proposes a compact trie representation and a hybrid data structure to reduce the memory requirement of virtual routers. The approach does not require leaf-pushing; therefore, reduces the size of each entry of the data structure. Our algorithm demonstrates substantial reduction in the memory footprint compared with the state-of-the-art. Also, it eliminates the shared next hop information data structure and simplifies the table updates in virtual routers. Using a state-of-the-art FPGA, the proposed architecture can support up to 3.1M IPv4 prefixes. Employing the dual-ported memory available in the current FPGAs, we map the proposed data structure on a novel SRAMbased linear pipeline architecture to achieve high throughput. The post place-and-route result shows that our architecture can sustain a throughput of 394 million lookups per second, or 126 Gbps (for the minimum packet size of 40 Bytes).

Virtualization allows heterogeneous networks to share same underlying physical substrate. A single router fulfills the roles of multiple virtual routers by maintaining all the forwarding tables. Therefore, multiple virtual routers can run on a single substrate router, and multiple organizations share this single physical router. A single router plays the role of multiple independent virtual routers while providing the necessary isolation and resource management. Hence, a virtual router should fulfill the following requirements:\begin{itemize} \item \emph{Fair resource usage}: Router resources should be fairly shared among the virtual routers. \item \emph{Fault isolation}: A fault occurring in a particular virtual network should not affect the operation of other virtual networks. \item \emph{Security}: Traffic from one virtual network should not be mixed with the traffic from any other virtual network. \end{itemize}Storing these virtual routing tables separately leads to a large memory requirement and poor resource sharing. Therefore, merging emerges to be a desirable solution. Existing merging algorithms use leaf pushing technique and a shared next hop data structure to eliminate the large memory bandwidth requirement. However, the size of the shared next hop table grows linearly with the number of virtual routers. Due to the limited on-chip memory and the number of I/O pins of Field Programmable Gate Arrays (FPGAs), existing designs cannot support large number of virtual routing tables and/or large number of prefixes. We propose a compact trie representation and a hybrid data structure to reduce the memory consumption of a single virtual router. Our data structure achieves substantial memory compression without the need for backtracking. The proposed hybrid data structure is also used to merge different virtual routing tables. The approach does not require leaf-pushing and reduces the size of each entry of the data structure. Our data structure achieves a substantial memory reduction of $2\times$ over the state-of-the-art solutions. Additionally, it eliminates the shared next hop information structure and simplifies the table updates in virtual routers. Using a state-of-the-art FPGA, the proposed architecture can support up to 3.1M IPv4 prefixes, employing both on-chip BRAM and external SRAM. Our implementation on FPGA shows a sustained throughput of $394$ million lookups per second. In summary, this paper makes the following contributions:\begin{enumerate} \item A compact trie representation and a hybrid data structure for IP lookup that reduces the memory consumption without backtracking. \item A merging algorithm that eliminates leaf pushing and simplifies the table updates in virtual routers. \item A linear pipelined SRAM-based architecture on FPGAs that can support up to $3.1$M prefixes, while achieving a sustained throughput of $394$ million lookups per second.\end{enumerate}

We propose a combined length-infix pipelined search (CLIPS) architecture for high-performance IP lookup on FPGA. By performing binary search in prefix length, CLIPS can find the longest prefix match in (log L-c) phases, where L is the IP address length (32 for IPv4) and c>;0 is a small design constant (c=2 in our prototype design). Each CLIPS phase matches one or more input infixes of the same length against a regular data structure. Various CLIPS phases can be optimized individually: (1) 16 bits of the IP address are used to direct-access a 288-kbit on-chip BRAM in phase 1, (2) 8 additional bits of the IP address are used to search a 1.5-million-entry pipelined dynamic search forest for a match in phase 2, (3) 1 to 8 additional bits of the IP address are used by a 2-stage Tree Bitmap for storing another 1 to 8 million routing prefixes in the tail phase. Post place-and-route results show that our CLIPS prototype, utilizing 28 Mbits on-chip BRAM and 4 external SRAM channels, sustains 312 MPPS IPv4 lookup (or 160 Gbps routing though put with 64-byte packets) against 9.5 million prefixes on state-of-the-art FPGA.

Most current SRAM-based high-speed Internet Protocol (IP) packet classification implementations use tree traversal and pipelining. However, these approaches result in inefficient memory utilization. Due to the limited amount of on-chip memory of the state-of-the-art Field Programmable Gate Arrays (FPGAs), existing designs cannot support large filter databases arising in backbone routers and intrusion detection systems. Hierarchical search structures for packet classification exhibit good memory performance and support quick rule update. However, pipelined hardware implementation of these algorithms suffer from inefficient resource and memory usage due to variation in the size of the trie nodes and backtracking. We propose a memory efficient organization denoted Clustered Hierarchical Search Structure (CHSS) for packet classification. We present a clustering algorithm that partitions a given filter database to reduce the memory requirement. We show that, using the resulting structure, backtracking is not needed to perform a search. We introduce two parameters (NRtrie, NRtree), which can be chosen based on the given filter database to achieve good memory efficiency. Our algorithm demonstrates substantial reduction in the memory footprint compared with the state-of-the-art. For all publicly available filter databases, the achieved memory efficiency is between 21.54 and 41.25 bytes per rule. We map the proposed data structure onto a linear pipeline architecture to achieve high throughput. Post place and route result using a state-of-the-art FPGA device shows that the design can sustain a throughput of 408 million packets per second, or 130.5 Gbps (for the minimum packet size of 40 Bytes).