Abstract:Deterministic Finite Automatons (DFAs) and Nondeterministic Finite Automatons (NFAs) are two typical automatons used in the Network Intrusion Detection System (NIDS). Although they both perform regular expression matching, they have quite different performance and memory usage properties. DFAs provide fast and deterministic matching performance but suffer from the well-known state explosion problem. NFAs are compact, but their matching performance is unpredictable and with no worst case guarantee. In this paper, we propose a new automaton representation of regular expressions, called Tunable Finite Automaton (TFA), to resolve the DFAs’ state explosion problem and the NFAs’ unpredictable performance problem. Different from a DFA, which has only one active state, a TFA allows multiple concurrent active states. Thus, the total number of states required by the TFA to track the matching status is much smaller than that required by the DFA. Different from an NFA, a TFA guarantees that the number of concurrent active states is bounded by a bound factor b that can be tuned during the construction of the TFA according to the needs of the application for speed and storage. Simulation results based on regular expression rule sets from Snort and Bro show that with only two concurrent active states, a TFA can achieve significant reductions in the number of states and memory usage, e.g., a 98% reduction in the number of states and a 95% reduction in memory space.

Using the Equivalence Class to Make the Automaton

Topological Entropy and Complexity of One Class of Cellular Automata Rules

On Equivalence Checking of Nondeterministic Finite Automata

A Myhill-Nerode style Characterization for Timed Automata With Integer Resets

Counter Machines and Distributed Automata: A Story about Exchanging Space and Time

Alternating Nominal Automata with Name Allocation

Notes on Equivalence and Minimization of Weighted Automata

When Equivalence and Bisimulation Join Forces in Probabilistic Automata

A Characterization of Totally Compatible Automata

Sweeping Permutation Automata

First-Order Quantification over Automata

On hybrid models of quantum finite automata

TFA : A Tunable Finite Automaton for Regular Expression Matching

Automata with Equational Constraints

Power of Counting by Nonuniform Families of Polynomial-Size Finite Automata

Weak and Nested Class Memory Automata

i dfa: A novel deterministic finite automaton without state explosion

A Fuzzy Automaton Model and Its Applications

Learning Realtime One-Counter Automata

Nominal Tree Automata With Name Allocation

A Customised Automata Algorithm and Toolkit for Language Learning and Application