We found the bottleneck of smart rule cache is the data structure we used to store the rules. We use PPDD(Pruned packet decison diagram) which is tree that grows quickly with the number of rules. Thus, besides multi-threading, we looked at other alternative trees.
We found hypercut is a good one. Hypercut is based on a decision tree structure. It has limited memory usage and fast classification speed. I run the source code of hypercut on several rulesets and corresponding trace files. It works file.
I'm now considering rewriting the source code of smart rule cache with hypercut decision tree.
No comments:
Post a Comment