## 4 Experiment Evaluation  
### Setup  
We used an Intel platform to evaluate our proposed FHBM algorithm; a summary of the hardware configuration used in our experiments is shown in Table 1. The HBM algorithm source code, obtained from the authors of [35], was used to create the FHBM algorithm. Source codes were compiled using GCC 4.8.4. The operating system was 64-bit Ubuntu 14.04 (kernel version 3.13).  
Three pattern sets (one from Snort [36] and two from ClamAV [37]) were used for performance evaluation. Snort is a free, open-source NIDS; ClamAV is free, open-source antivirus software. According to the pattern set statistics shown in Table 2, the Snort set contained the largest number of patterns, but the number of characters was the smallest among the three, since the maximum depth of the Snort pattern set was smaller than those of the other two. As shown in Table 2, the longest patterns were 232 bytes for Snort, 362 for ClamAV type 1, and 382 for ClamAV type 3. According to the pattern length distributions of all sets, most ClamAV type 1 and ClamAV type 3 patterns were longer than 16 bytes, but only 43.9% of the Snort patterns exceeded 16 bytes (Table 3). This clarifies the relationship between the pattern and character numbers shown in Table 2.  
For each pattern set, three input data streams with different match ratios (1, 8, 32%) were generated to simulate different levels of attacks. For a given pattern set, the match ratio of an input data stream refers to the proportion of the length of malicious content to the length of the input data stream.  
\begin{table}
\begin{tabular}{l c c} \hline \hline  & **Component** & **Specification** \\ \hline Main board & Brand/Model & Asus/PSHF7-V \\ \hline  & Brand/Model & Intel/i7-3770 \\  & Number of cores & 4 \\ CPU & Frequency & 3.4 Ghz \\  & L1 cache size & 256 KB \\  & L2 cache size & 1024 KB \\  & L3 cache size & 8 MB \\ \hline  & Type & DDR3 \\ Main memory & Size & 8 GB \\  & Frequency & 1600 Mhz \\ \hline \hline \end{tabular}
\end{table}
Table 1: Hardware configuration for the experiments.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Pattern Length** & \multicolumn{2}{c}{**Snort**} & \multicolumn{2}{c}{**ClamAV Type 1**} & \multicolumn{2}{c}{**ClamAV Type 3**} \\ \hline \(\leq\) 4 & 977 & (11.3\%) & 56 & (1.1\%) & 7 & (0.2\%) \\
5–8 & 1559 & (18.0\%) & 81 & (1.5\%) & 29 & (1.0\%) \\
9–12 & 1284 & (14.8\%) & 103 & (2.0\%) & 53 & (1.8\%) \\
13–16 & 1045 & (12.0\%) & 92 & (1.8\%) & 62 & (2.1\%) \\ \(>\) 16 & 3808 & (43.9\%) & 4916 & (93.7\%) & 2748 & (94.8\%) \\ Total count & 8673 & & 5248 & & 2899 & \\ \hline \hline \end{tabular}
\end{table}
Table 2: Pattern set statistics.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Pattern Set** & **Number of Patterns** & **Number of Characters** & **Number of Depths** \\ \hline Snort & 8673 & 196,967 & 232 \\ ClamAV type 1 & 5248 & 498,014 & 362 \\ ClamAV type 3 & 2899 & 262,256 & 382 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Pattern length distribution.  
A substring in the input data stream is considered malicious if it is a significant prefix string of any pattern in the pattern set. A prefix string is significant if it covers a significant part (e.g., \(>\)80%) of the full string. For each input data stream, according to the match ratio, proper prefixes were randomly chosen from the pattern set and embedded into a clean data stream. For the Snort pattern set, the plain text from an HTML-formatted King James Bible was used as the clean data stream. For the ClamAV type 1 and ClamAV type 2 pattern sets, all files under /usr/bin in a typical Linux server installation were concatenated to be the clean data stream. Since both the HBM and FHBM algorithms were designed for multi-core platforms, and since the experimental platform has four physical cores, we created four threads, with each performing its own pattern matching task using the shared HBFA. All data represent averages from 100 simulations.