# Length-Bounded Hybrid CPU/GPU Pattern Matching Algorithm for Deep Packet Inspection
## 4 Experiments
### Experimental Results
Since the number of short payloads in the GPU device memory is more than that of longer payloads, more benefits from multithread parallel processing can be made due to the number of GPU cores being much larger than the number of CPU cores. With respect to the LHPMA results, we initially observe the effect of payload length bound on LHPMA. The LHPMA performance, with the packet trace described in the previous subsection as  
Figure 5: The GPUs with different full matching buffer sizes. Figure 6: The performance of GPU processing with different lengths of input payloads. input, and different settings of bound \(L_{b}\) are displayed in Figure 7. The \(x\)-axis represents the selected \(L_{b}\) values, and the \(y\)-axis indicates the average throughputs in Gbps. According to this figure, the case of \(L_{b}\) = 0 indicates that all of the incoming packets passed the prefilter with performance 12.7 Gbps. As the \(L_{b}\) value increased, the performance upgraded to 14.0 Gbps. In particular, a specific case appeared with \(L_{b}\) = 750, which corresponded to the result in Figure 6. In other words, since the payload length diversity is reduced, some performance gains were thus obtained. On the other hand, the case of \(L_{b}\) = 1460 revealed a performance degradation of 5.9 Gbps. This is because all of the incoming packets were sent to the GPU without passing the prefiltering. The degradation was caused by both data transfer latency and payload length diversity. For demonstrating the improvement to the previous work HPMA and the CPU/GPU cooperation that is more efficient than using either CPU only or GPU only, the comparison is displayed in Figure 8. The input traffic is also the packet trace described in the previous subsection. The \(x\)-axis represents the different matching methods, and the \(y\)-axis indicates the average throughputs performed in Gbps. Here, the middle of the bound, \(L_{b}\) = 750, is chosen for the LHPMA-AC. According to this figure, the LHPMA-AC, HPMA-AC, AC-GPU and AC-CPU, respectively, performed 13.8, 12.7, 5.9 and 4.6 Gbps, indicating that the LHPMA enhanced performance more than the HPMA and outperformed the AC-GPU and the AC-CPU methods by 2.3 and 3.0 times, respectively. Figure 8: The performance of LHPMA and comparison with the previous methods. Figure 7: The performance of LHPMA with different payload length boundaries. Since the conditions of other related work were quite different each other (e.g., configuration setting, input packet traffic set, pattern set and hardware specification), it is hard to make comparisons. Therefore, we provide a presentation referred from [26] that illustrates the efficiency per cost of our method, as presented in Table 3. According to the resulting LHPMA throughput (13.8 Gbps) and the total processor cost of CPU and GPU being Figure 4:0. Table 4 presents the full-matched (considered intrusive) packet distribution of the input packet trace traffic. The result shows that most of the short packets are intrusive; even the number of longer packets are much more in this case, and the ratio of intrusion in the shorter packets are up to 88% higher than that in longer packets. It indicates that shorter packets are usually selected as the way to generate the intrusion.