High-Speed Network Flow Classification: A Study and Design Based on FPGA

Network packet flow classification is the fundamental method for managing the security of network packets and is extensively applied within network security management systems, including network security isolation, intrusion protection, and security encryption. With the exponential growth of digital information in recent years, the rate of new-generation network communications has progressively escalated from the traditional 10 / 100 / 1000 M to the ultra-high-speed 10G / 40G / 100G. The ultra-high-speed network communication rate also brings new challenges to the performance of network data stream classification. This paper investigates four traditional mainstream network flow classification methods: rule tree matching, Ternary Content Addressable Memory (TCAM) matching, Hash table matching and direct comparison matching. A thorough analysis of the strengths and weaknesses of each method is presented. Given the absence of a method capable of dynamically updating the rule base, while simultaneously achieving full fuzzy matching of a high- speed, extensive rule base, this paper introduces a novel highspeed network flow classification approach using FieldProgrammable Gate Array (FPGA) technology. This method uses BRAM to build a rule array, calls DSP48E1 hard core and LUT resources in FPGA in a resource-balanced way to build a comparator, rearranges and splices the network data flow, and then matches it in parallel. The method is verified on the XC7V690T chip of XILINX. The results show that when performing 1000 five-tuple rule matching of fully fuzzy network, this method can not only update the five-tuple rule set in real time, but also use only 55,745 LUTs 1600 DSPs and 400 BRAMs resources to achieve the processing performance of 153MPPS throughput and 125ns latency, exceeding the minimum packet linear matching rate of 100G network.