Bitmap index design and evaluation
SIGMOD '98 Proceedings of the 1998 ACM SIGMOD international conference on Management of data
Balls and bins: a study in negative dependence
Random Structures & Algorithms
A fast string searching algorithm
Communications of the ACM
Space/time trade-offs in hash coding with allowable errors
Communications of the ACM
New directions in traffic measurement and accounting
IMW '01 Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement
New Algorithms for Subset Query, Partial Match, Orthogonal Range Searching, and Related Problems
ICALP '02 Proceedings of the 29th International Colloquium on Automata, Languages and Programming
Efficient Mapping of Range Classifier into Ternary-CAM
HOTI '02 Proceedings of the 10th Symposium on High Performance Interconnects HOT Interconnects
Reducing TCAM Power Consumption and Increasing Throughput
HOTI '02 Proceedings of the 10th Symposium on High Performance Interconnects HOT Interconnects
Packet classification using multidimensional cutting
Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications
Fast Content-Based Packet Handling for Intrusion Detection
Fast Content-Based Packet Handling for Intrusion Detection
Analysis of associative retrieval algorithms.
Analysis of associative retrieval algorithms.
Optimizing subset queries: a step towards SQL-based inductive databases for itemsets
Proceedings of the 2004 ACM symposium on Applied computing
Algorithms for advanced packet classification with ternary CAMs
Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
Survey and taxonomy of packet classification techniques
ACM Computing Surveys (CSUR)
Multipattern string matching with q-grams
Journal of Experimental Algorithmics (JEA)
Fast data stream algorithms using associative memories
Proceedings of the 2007 ACM SIGMOD international conference on Management of data
Efficient multi-match packet classification with TCAM
HOTI '04 Proceedings of the High Performance Interconnects, 2004. on Proceedings. 12th Annual IEEE Symposium
Hash-AV: fast virus signature scanning by cache-resident filters
International Journal of Security and Networks
MRSI: A Fast Pattern Matching Algorithm for Anti-virus Applications
ICN '08 Proceedings of the Seventh International Conference on Networking
Topological transformation approaches to optimizing TCAM-based packet classification systems
Proceedings of the eleventh international joint conference on Measurement and modeling of computer systems
Similarity search and locality sensitive hashing using ternary content addressable memories
Proceedings of the 2010 ACM SIGMOD International Conference on Management of data
Algorithms for packet classification
IEEE Network: The Magazine of Global Internetworking
Virtually cool ternary content addressable memory
HotOS'13 Proceedings of the 13th USENIX conference on Hot topics in operating systems
COCA filters: co-occurrence aware bloom filters
SPIRE'11 Proceedings of the 18th international conference on String processing and information retrieval
A resistive TCAM accelerator for data-intensive computing
Proceedings of the 44th Annual IEEE/ACM International Symposium on Microarchitecture
The evicted-address filter: a unified mechanism to address both cache pollution and thrashing
Proceedings of the 21st international conference on Parallel architectures and compilation techniques
A novel approach for leveraging co-occurrence to improve the false positive error in signature files
Journal of Discrete Algorithms
Software defined traffic measurement with OpenSketch
nsdi'13 Proceedings of the 10th USENIX conference on Networked Systems Design and Implementation
AC-DIMM: associative computing with STT-MRAM
Proceedings of the 40th Annual International Symposium on Computer Architecture
Hi-index | 0.00 |
Associative memories offer high levels of parallelism in matching a query against stored entries. We design and analyze an architecture which uses single lookup into a Ternary Content Addressable Memory (TCAM) to solve the subset query problem for small sets, i.e., to check whether a given set (the query) contains (or alternately, is contained in) any one of a large collection of sets in a database. We use each TCAM entry as a small Ternary Bloom Filter (each 'bit' of which is one of {0,1,wildcard}) to store one of the sets in the collection. Like Bloom filters, our architecture is susceptible to false positives. Since each TCAM entry is quite small, asymptotic analyses of Bloom filters do not directly apply. Surprisingly, we are able to show that the asymptotic false positive probability formula can be safely used if we penalize the small Bloom filter by taking away just one bit of storage and adding just half an extra set element before applying the formula. We believe that this analysis is independently interesting. The subset query problem has applications in databases, network intrusion detection, packet classification in Internet routers, and Information Retrieval. We demonstrate our architecture on one illustrative streaming application -- intrusion detection in network traffic. Be shingling (i.e., taking consecutive bytes of) the strings in the database, we can perform a single subset query and hence a single TCAM search, to skip many bytes in the stream. We evaluate our scheme on the open source CLAM anti-virus database, for worst-case as well as random streams. Our architecture appears to be at least one order of magnitude faster than previous approaches. Since the individual Bloom filters must fit in a single TCAM entry (currently 72 to 576 bits), our solution applies only when each set is of a small cardinality. However, this is sufficient for many typical applications. Also, recent algorithms for the subset-query problem use a small-set version as a subroutine