HyperScan
SOLUTION WHITE PAPER
Intel® processors
Pattern Matching Library Software
EXECUTIVE SUMMARY
HyperScan is a software pattern matching library that can match large groups of regular
expressions against blocks or streams of data. Ideal for applications that need to scan
large amounts of data at high speed, such as Intrusion Prevention (IPS), Antivirus
(AV), Unied Threat Management (UTM) and Deep Packet Inspection (DPI) systems,
HyperScan runs entirely in software and is deployed on a wide range of Intel® processors
and operating systems.
“HyperScan’s runtime is
engineered for high-performance
from the ground up.”
A High-Performance Regular Expression Matching Engine
Design
HyperScan delivers the highest scanning
performance, with all congurations
done through function calls by the calling
application. It can be broadly split up into
‘compiler’ and ‘runtime’ components.
Compiler
• Patterns for HyperScan are specied in
the industry standard PCRE format.
• A set of patterns is compiled into a xed
database, targeted for a particular mode
of operation (such as streaming mode
or block mode) and a particular target
platform (e.g., Intel® Atom™ processor or
Intel® Xeon® processor).
• A HyperScan database can be used in-
memory after compilation, or serialized
and shipped off to another system for use.
Runtime
The HyperScan runtime presents a
synchronous API that matches data
against a compiled pattern database,
returning each match discovered to the
application via a callback. HyperScan’s
runtime is engineered for high
performance from the ground up:
• Each architecture port takes advantage
of advanced processor features (such as
SIMD instruction sets) where available.
• Pattern databases are read-only at
runtime, enabling efcient use of a
single database by multiple concurrent
threads or processes.
• Not a backtracking engine: memory
usage at runtime is xed and small,
making it appropriate for resource-
constrained environments.
• Software-only, synchronous approach
enables good performance even in
scenarios with small writes and high
match rates.
评论4