Abstract:Deep packet inspection at high speed has become extremely important due to its application in a wide range of network applications, such as network security and network monitoring. Network intrusion detection system (NIDS) uses a collection of signatures of known security threats and viruses to scan the payload of each packet. Signatures are often specified in the form of regular expressions (regex), called patterns, which are traditionally implemented as finite automata. Deterministic finite automata (DFA) is fast, but requires prohibitive amounts of memory which limits their practical use. Instead of matching an incoming packet with each individual regex in a ruleset, we match the packet with a fixed substring, called fingerprint, of a regex first. Fixed string matching is faster and consumes less energy than regex matching. The fact is that if a packet does not match with the fingerprint of a regex, it will not match the regex itself. So fingerprints can be used in a prefilter engine to filter out those packets and do not match any of the fingerprints of the regex in a rule set, which represents normal non-malicious traffic. This actually reduces the number of regex rules being matched, which results in increased throughput of the NIDS. We present a weight scheme to extract a good fingerprint from a regex. A good fingerprint is the one that not only indicates the regex uniquely, but also occurs as less as possible in the matching procedure. We demonstrate how to use fingerprints for efficient prefiltering by means of Bloom filters in practice.

EFA for efficient regular expression matching in NIDS

TFA : A Tunable Finite Automaton for Regular Expression Matching

Pattern-Based DFA for Memory-Efficient and Scalable Multiple Regular Expression Matching.

TCAM-based DFA Deflation: a Novel Approach to Fast and Scalable Regular Expression Matching

Reorganized and Compact DFA for Efficient Regular Expression Matching

TFA: A Tunable Finite Automaton for Pattern Matching in Network Intrusion Detection Systems.

Offset-FA: Detach the Closures and Countings for Efficient Regular Expression Matching

Offset-FA: A Uniform Method to Handle Both Unbounded and Bounded Repetitions in Regular Expression Matching

Cache-Based Scalable Deep Packet Inspection with Predictive Automaton.

StriFA: Stride Finite Automata for High-Speed Regular Expression Matching in Network Intrusion Detection Systems

i dfa: A novel deterministic finite automaton without state explosion

Extraction of Fingerprint from Regular Expression for Efficient Prefiltering

TCAM-based NFA Implementation

Parallel Dfa Architecture For Ultra High Throughput Dfa-Based Pattern Matching

Treating Insomnia, Amnesia, and Acalculia in Regular Expression Matching

Intelligent and Efficient Grouping Algorithms for Large-Scale Regular Expressions

Deflation Dfa: Remembering History Is Adequate

Parallel Architecture for High Throughput DFA-Based Deep Packet Inspection

StriD²FA: Scalable Regular Expression Matching for Deep Packet Inspection

A Regular Expression Matching Approach to Distributed Wireless Network Security System.

Intelligent grouping algorithms for regular expressions in deep inspection