Efficient Byte Stream Pattern Test using Bloom Filter with Rolling Hash Functions on the FPGA

Abstract

The main purpose of this paper is to present an efficient FPGA implementation for the Bloom filter, in which a large set P of l-byte patterns are registered beforehand. Our Bloom filter circuit performs the byte stream pattern test such that it receives an input byte stream t and outputs the bit stream in every clock cycle. Each bit of the output bit stream is 1 if an l-byte sequence of t starting from the corresponding position is identical with one of the patterns in P. Such byte stream pattern test has a lot of applications. For example, it can be used for detecting malicious patterns in byte stream of network traffic. Our Bloom filter circuit fully utilizes 288K-bit Ultra RAMs and 18K-bit Block RAMs in the Xilinx UltraScale+ VU9P FPGA. We use Ultra RAMs to implement bit arrays to register all patterns in P and Block RAMs to compute signatures using rolling hash functions. Unlike the previously published FPGA implementations of the Bloom filter, which use XOR-based hash functions, our Bloom filter circuit using rolling hash functions can support much larger l. We have evaluated the performance of our Bloom filter circuit using Xilinx UltraScale+ FPGA VU9P, which is a popular high-end FPGA used in Amazon Web Service. The experimental results show that our Bloom filter circuit for 4800K (=4,915,200) patterns of length 1024 can perform the byte stream pattern test for 1.14Gbps input byte stream with false positive probability 10^-12. Also, we can configure our Bloom filter circuit to work for 100K (=102,400) patterns of length 1024 and 49.5Gpbs input byte stream with the same false positive probability.