Electrical and Electronic Engineering, Hardware and Architecture, Computer Networks and Communications, Artificial Intelligence
18
Scopus Publications
Scopus Publications
Breaking the Scalability Barrier of Content Addressable Memories: A Probabilistic Alternative for Large-Key Associative Search Arish Sateesan, Jo Vliegen, Nele Mentens ACM Transactions on Reconfigurable Technology and Systems, 2026 Content Addressable Memories (CAMs) offer high-speed, deterministic lookups but face significant scalability challenges with large input keys ( \( > \) 100 bits), leading to excessive power, silicon area, and memory costs. This article introduces Probabilistic CAM (P-CAM), a novel architecture designed to overcome these limitations by trading strict determinism for memory efficiency and scalability. P-CAM compresses high-dimensional inputs into fixed-size fingerprints using hashing, making memory requirements independent of key length. P-CAM preserves the constant-time lookup advantage of CAMs, while supporting applications with large keys, such as networking, bioinformatics, and machine learning, where conventional CAMs are impractical. FPGA implementation on Xilinx UltraScale+ devices shows that P-CAM maintains constant query latency and delivers 15 \(\times\) improvement in resource efficiency when handling 384-bit keys, compared to state-of-the-art deterministic CAMs designed for narrower inputs. Although P-CAM’s probabilistic nature introduces a small, controllable false-positive rate, it can be configured for fully deterministic operation under specific constraints. To the best of our knowledge, P-CAM is the first CAM architecture to employ a fingerprint-based probabilistic data structure as the primary storage mechanism for associative lookup, distinguishing it from prior probabilistic approaches that are limited to set membership checks, offering a robust and scalable alternative for modern data-intensive systems.
SPArch: A Hardware-oriented Sketch-based Architecture for High-speed Network Flow Measurements Arish Sateesan, Jo Vliegen, Simon Scherrer, Hsu-Chun Hsiao, Adrian Perrig, et al. ACM Transactions on Privacy and Security, 2024 Network flow measurement is an integral part of modern high-speed applications for network security and data-stream processing. However, processing at line rate while maintaining the required data structure within the on-chip memory of the hardware platform is a challenging task for measurement algorithms, especially when accuracy is of primary importance, such as in network security applications. Most of the existing measurement algorithms are no exception to such issues when deployed in high-speed networking environments and are also not tailored for efficient hardware implementation. Sketch-based measurement algorithms minimize the memory requirement and are suitable for high-speed networks but possess a low memory-accuracy trade-off and lack the versatility of individual flow mapping. To address these challenges, we present a hardware-friendly data structure named Sketch-based Pseudo-associative array Architecture (SPArch). SPArch is highly accurate and extremely memory-efficient, making it suitable for network flow measurement and security applications. The parallelism in SPArch ensures minimal and constant memory access cycles. Unlike other sketch architectures, SPArch provides the functionality of individual flow mapping similar to associative arrays, and the optimized version of SPArch allows the organization of counters in multiple buckets based on the flow sizes. An in-depth analysis of SPArch is carried out in this article and implemented SPArch on the Alveo data center accelerator card, demonstrating its suitability for high-speed networks.
ALBUS: A Probabilistic Monitoring Algorithm to Counter Burst-Flood Attacks Simon Scherrer, Jo Vliegen, Arish Sateesan, Hsu-Chun Hsiao, Nele Mentens, et al. Proceedings of the IEEE Symposium on Reliable Distributed Systems, 2023 Modern DDoS defense systems rely on probabilistic monitoring algorithms to identify flows that exceed a volume threshold and should thus be penalized. Commonly, classic sketch algorithms are considered sufficiently accurate for usage in DDoS defense. However, as we show in this paper, these algorithms achieve poor detection accuracy under burst-flood attacks, i.e., volumetric DDoS attacks composed of a swarm of medium-rate sub-second traffic bursts. Under this challenging attack pattern, traditional sketch algorithms can only detect a high share of the attack bursts by incurring a large number of false positives. In this paper, we present ALBUS, a probabilistic monitoring algorithm that overcomes the inherent limitations of previous schemes: ALBUS is highly effective at detecting large bursts while reporting no legitimate flows, and therefore improves on prior work regarding both recall and precision. Besides improving accuracy, ALBUS scales to high traffic rates, which we demonstrate with an FPGA implementation, and is suitable for programmable switches, which we showcase with a P4 implementation.
SoK - Network Intrusion Detection on FPGA Laurens Le Jeune, Arish Sateesan, Md Masoom Rabbani, Toon Goedemé, Jo Vliegen, et al. Lecture Notes in Computer Science Including Subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics, 2022
Speed records in network flow measurement on FPGA Arish Sateesan, Jo Vliegen, Simon Scherrer, Hsu-Chun Hsiao, Adrian Perrig, et al. Proceedings 2021 31st International Conference on Field Programmable Logic and Applications Fpl 2021, 2021