Abstract:Regular expressions (regexes) provide rich expressiveness to specify the signatures of intrusions and are widely used in contemporary network security systems for signature-based intrusion detection. To perform very fast regex matching, deterministic finite automata (DFA) has been the first choice because its time complexity is constant O ( 1 ) . Unfortunately, DFA often suffers the well known state explosion problem and, consequently, tends to require prohibitive memory overhead in practical applications. To address the problem, a wide variety of DFA compression techniques have been proposed; however, few can keep up with the ever increasing network traffic bandwidth and regex set complexity. This paper proposes that the DFA problem is rooted in regexes (rather than in DFA), i.e., semantic overlapping of regexes, and accordingly presents a complete algorithmic solution PaCC (Partition, Compression, and Combination), that can transform the given large-scale set of complex regexes into a compact and fast matching engine using DFA as its core. PaCC fundamentally defuses state explosion for DFA by partitioning complex regexes into overlapping-free segments. By exploiting the massive repetitiveness among the resulting segments, PaCC can further deflate corresponding DFA in terms of the number of states. Moreover, on the basis of the characteristics of these segments, PaCC takes a tailor-made compression approach and reduces over 96% of the state transitions for the corresponding DFA. In the final matching engine, the combination of DFA and a small relation mapping table, built from segments and their syntagmatic relations, respectively, guarantees high performance and semantic equivalence. Experimental evaluation shows that PaCC produces succinct matching engines with memory usage proportional to the size of the real-world Snort and Bro regex sets, with speeds of up to 1.7Gbps per core on a HP Z220 SFF workstation with a 3.40GHz Intel Core i7-3770.

StriD²FA: Scalable Regular Expression Matching for Deep Packet Inspection

Strid(2)Fa: Scalable Regular Expression Matching For Deep Packet Inspection

StriFA: Stride Finite Automata for High-Speed Regular Expression Matching in Network Intrusion Detection Systems

Parallel Architecture for High Throughput DFA-Based Deep Packet Inspection

Accelerating Deep Packet Inspection With SIMD-Based Multi-Literal Matching Engine

Cache-Based Scalable Deep Packet Inspection with Predictive Automaton.

P4rex: Accelerating Regular Expression Matching with Programmable Switches

SRD-DFA: Achieving Sub-rule Distinguishing with Extended DFA Structure

Fast String Matching with Overlapped Substring Classifier in Deep Packet Inspection Systems

BSPM: A New Mechanism for “Overlap-Matching Expressions” in DPI

Compact DFA Structure for Multiple Regular Expressions Matching

Extraction of Fingerprint from Regular Expression for Efficient Prefiltering

Ultra-High Throughput String Matching for Deep Packet Inspection

A Multiple Simple Regular Expression Matching Architecture and Coprocessor for Deep Packet Inspection

Parallel Dfa Architecture For Ultra High Throughput Dfa-Based Pattern Matching

A Memory-Efficient Parallel String Matching Architecture for High-Speed Intrusion Detection

Practical Regular Expression Matching Free of Scalability and Performance Barriers

Reorganized and Compact DFA for Efficient Regular Expression Matching

P4CTM: Compressed Traffic Pattern Matching Based on Programmable Data Plane

SPC-FA: synergic parallel compact finite automaton to accelerate multi-string matching with low memory.

Another CDFA Based Multi-Pattern Matching Algorithm and Architecture for Packet Inspection.