Bouma2 - A Quasi-Stateless, Tunable Multiple String-Match Algorithm

TL;DR

Bouma2 introduces a quasi-stateless, tunable multiple string-match algorithm that outperforms traditional state-machine approaches in speed and memory efficiency, adaptable to input characteristics.

Contribution

The paper presents Bouma2, a novel quasi-stateless string-matching algorithm optimized via weighted Integer Linear Programming, reducing overhead and enhancing performance.

Findings

Doubling throughput compared to Aho-Corasick

Uses approximately 10% of memory of traditional methods

Input-sensitive tuning improves efficiency

Abstract

The Bouma2 algorithm attempts to challenge the prevalent "stateful" exact string-match paradigms by suggesting a "quasi-stateless" approach. We claim that using state-machines to solve the multiple exact string-match problem introduces a hidden artificial constraint, namely the Consume-Order Dependency, which results in unnecessary overhead. Bouma2 is not restricted in this sense; we postulate that this allows memory-efficiency and improved performance versus its state-machine equivalents. The heart of the Bouma2 preprocessing problem is formulated as a weighted Integer Linear Programming problem, that can be tuned for memory footprint and performance optimization. Specifically, this allows Bouma2 to be input-sensitive, as tuning can be based on input characteristics. Evaluating Bouma2 against the Aho-Corasick variant of the popular Snort Intrusion Prevention System, we demonstrate double the throughput while using about 10% of the memory.