An improved DFA for fast regular expression matching

Ficara, Domenico; Giordano, Stefano; Procissi, Gregorio; Vitucci, Fabio; Antichi, Gianni; Pietro, Andrea Di

doi:10.1145/1452335.1452339

Cited by 128 publications

(81 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Except for this serialization, everything else is as in Algorithm 2 and we omit showing the common parts. The duration of one step (lines [6][7][8][9][10][11][12][13][14] increases and the number of steps decreases as compared to Algorithm 1. The two memory accesses at lines 9-10 can overlap in time, so the duration of a step increases but does not double.…”

Section: B Sppm For Single-threaded Softwarementioning

confidence: 99%

“…In principle, DFA-based regular expression matching yields high matching speeds, but combined DFAs often produce a state-space explosion [24] with infeasible memory requirements. Many techniques have been proposed to reduce the DFA state space [24], [25], or to perform edge compression [3], [9], [14], [16]. These techniques are orthogonal to our own, which focuses specifically on latency and can be readily applied to strings or regular expressions with or without alternative encoding.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Speculative Parallel Pattern Matching

Luchaup

Smith

Estan

et al. 2011

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

Abstract-Intrusion prevention systems (IPSs) determine whether incoming traffic matches a database of signatures, where each signature is a regular expression and represents an attack or a vulnerability. IPSs need to keep up with ever-increasing line speeds, which has lead to the use of custom hardware. A major bottleneck that IPSs face is that they scan incoming packets one byte at a time, which limits their throughput and latency. In this paper, we present a method to search for arbitrary regular expressions by scanning multiple bytes in parallel using speculation. We break the packet in several chunks, opportunistically scan them in parallel, and if the speculation is wrong, correct it later. We present algorithms that apply speculation in single-threaded software running on commodity processors as well as algorithms for parallel hardware. Experimental results show that speculation leads to improvements in latency and throughput in both cases.Index Terms-Low latency, multibyte, multibyte matching, parallel pattern matching, parallel regular expression matching, regular expressions, speculative pattern matching.

show abstract

Section: B Sppm For Single-threaded Softwarementioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Speculative Parallel Pattern Matching

Luchaup

Smith

Estan

et al. 2011

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

show abstract

“…The number of states and transitions were decreased by the Delta finite automaton [8] approach. The diversity between nearby states which have many familiar transitions was stored in this approach [8].…”

Section: Related Workmentioning

confidence: 99%

“…The diversity between nearby states which have many familiar transitions was stored in this approach [8]. The size of input alphabet table was decreased by alphabet compression table [9] approach.…”

Section: Related Workmentioning

confidence: 99%

A Memory Efficient Regular Expression Matching by Compressing Deterministic Finite Automata

Pisolkar¹,

Lahane²

2015

IJCA

View full text Add to dashboard Cite

Regular expressions are very meaningful and now-a-days broadly used to represent signatures of various attacks. The focal component of today's security systems like intrusion detection and prevention system is a signature based regular expression matching. Deterministic finite automaton is often used to represent regular expressions. In regular expression matching, storage space of Deterministic finite automata is very important concern. A massive amount of memory is essential to store transition function of Deterministic finite automata. The method described in this paper reduces size of Deterministic finite automata which is in regular expression format. The performance of the regular expression matching by compressing Deterministic finite automata is evaluated by using regular expression set. General TermsPattern matching algorithms, Network Security, Theory of Computations. KeywordsRegular expressions; security attacks; deterministic finite automata; intrusion detection and prevention.

show abstract

“…As DFA is the preferred representation of RegEx matching, recent work has focused on reducing the huge memory usage of DFA-based RegEx matching [4,[6][7][8][9][10][11]. However, they achieve memory reduction only for signature sets of simple or specific RegExes.…”

Section: Related Workmentioning

confidence: 99%

A Prefiltering Approach to Regular Expression Matching for Network Security Systems

Liu

Sun

Liu

et al. 2012

Applied Cryptography and Network Security

View full text Add to dashboard Cite

Abstract. Regular expression (RegEx) matching has been widely used in various networking and security applications. Despite much effort on this important problem, it remains a fundamentally difficult problem. DFA-based solutions can achieve high throughput, but require too much memory to be executed in high speed SRAM. NFA-based solutions require small memory, but are too slow. In this paper, we propose RegexFilter, a prefiltering approach. The basic idea is to generate the RegEx print of RegEx set and use it to prefilter out most unmatched items. There are two key technical challenges: the generation of RegEx print and the matching process of RegEx print. The generation of RegEx is tricky as we need to tradeoff between two conflicting goals: filtering effectiveness, which means that we want the RegEx print to filter out as many unmatched items as possible, and matching speed, which means that we want the matching speed of the RegEx print as high as possible. To address the first challenge, we propose some measurement tools for RegEx complexity and filtering effectiveness, and use it to guide the generation of RegEx print. To address the second challenge, we propose a fast RegEx print matching solution using Ternary Content Addressable Memory. We implemented our approach and conducted experiments on real world data sets. Our experimental results show that RegexFilter can speedup the potential throughput of RegEx matching by 21.5 times and 20.3 times for RegEx sets of Snort and L7-Filter systems, at the cost of less than 0.2 Mb TCAM chip.

show abstract

An improved DFA for fast regular expression matching

Cited by 128 publications

References 19 publications

Speculative Parallel Pattern Matching

Speculative Parallel Pattern Matching

A Memory Efficient Regular Expression Matching by Compressing Deterministic Finite Automata

A Prefiltering Approach to Regular Expression Matching for Network Security Systems

Contact Info

Product

Resources

About