Evaluating regular expression matching engines on network and general purpose processors

Becchi, Michela; Wiseman, Charlie; Crowley, Patrick

doi:10.1145/1882486.1882495

Cited by 47 publications

(33 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The use of REs to describe attack signatures is well established in the literature [3], [23], [26], [24]. DFA representations for REs [10] offer deterministic matching time and memory bandwidth, but scan only one byte at a time.…”

Section: Related Workmentioning

confidence: 99%

“…They generate a compact representation similar to a DFA, but using additional memory and code. They however assume REs consisting of non-overlapping patterns interleaved by · * terms, an assumption that may not always be valid in practice [3]. Other techniques decrease the memory footprint of a DFA by performing state [12] or alphabet [2] compression, or more sophisticated forms of encoding [14].…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Deep packet inspection with DFA-trees and parametrized language overapproximation

Luchaup

Carli

Jha

et al. 2014

IEEE INFOCOM 2014 - IEEE Conference on Computer Communications

View full text Add to dashboard Cite

IPSs determine whether incoming traffic matches a database of vulnerability signatures defined as regular expressions. DFA representations are popular, but suffer from the state-explosion problem. We introduce a new matching structure: a tree of DFAs where the DFA associated with a node overapproximates those at its children, and the DFAs at the leaves represent the signature set. Matching works top-down, starting at the root of the tree and stopping at the first node whose DFA does not match. In the common case (benign traffic) matching does not reach the leaves. DFA-trees are built using Compact Overapproximate DFAs (CODFAs). A CODFA D for D overapproximates the language accepted by D, has a smaller number of states than D, and has a low false-match rate. Although built from approximate DFAs, DFA-trees perform exact matching faster than a commonly used method, have a low memory overhead and a guaranteed good worst case performance.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Deep packet inspection with DFA-trees and parametrized language overapproximation

Luchaup

Carli

Jha

et al. 2014

IEEE INFOCOM 2014 - IEEE Conference on Computer Communications

View full text Add to dashboard Cite

show abstract

“…", "*") in their signature representation [18]. Some patterns even contain more than 10 such wildcard fragments.…”

Section: Smmentioning

confidence: 99%

A Lightweight Software Model for Signature-Based Application-Level Traffic Classification System

Park

Yoon

Won

et al. 2014

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYInternet traffic classification is an essential step for stable service provision. The payload signature classifier is considered a reliable method for Internet traffic classification but is prohibitively computationally expensive for real-time handling of large amounts of traffic on high-speed networks. In this paper, we describe several design techniques to minimize the search space of traffic classification and improve the processing speed of the payload signature classifier. Our suggestions are (1) selective matching algorithms based on signature type, (2) signature reorganization using hierarchical structure and traffic locality, and (3) early packet sampling in flow. Each can be applied individually, or in any combination in sequence. The feasibility of our selections is proved via experimental evaluation on traffic traces of our campus and a commercial ISP. We observe 2 to 5 times improvement in processing speed against the untuned classification system and Snort Engine, while maintaining the same level of accuracy.

show abstract

“…However, state-space explosion of the resulting DFA can greatly increase the amount of required memory, which could in turn impact the memory performance and even the practical feasibility of the solution. Various techniques were proposed to compress the state transition table (STT) of the DFA with nondeterministic features [8,14,17,18,24], achieving moderately high matching throughput [9]. These techniques, however, can be computationally expensive and are often designed a-posteriori to a particular set (or type) of regexes.…”

Section: Related Workmentioning

confidence: 99%

Space-time tradeoff in regular expression matching with semi-deterministic finite automata

Yang

Prasanna

2011

2011 Proceedings IEEE INFOCOM

View full text Add to dashboard Cite

Abstract-Regular expression matching (REM) with nondeterministic finite automata (NFA) can be computationally expensive when a large number of patterns are matched concurrently. On the other hand, converting the NFA to a deterministic finite automaton (DFA) can cause state explosion, where the number of states and transitions in the DFA are exponentially larger than in the NFA. In this paper, we seek to answer the following question: to match an arbitrary set of regular expressions, is there a finite automaton that lies between the NFA and DFA in terms of computation and memory complexities? We introduce the semideterministic finite automata (SFA) and the state convolvement test to construct an SFA from a given NFA. An SFA consists of a fixed number (p) of constituent DFAs (c-DFA) running in parallel; each c-DFA is responsible for a subset of states in the original NFA. To match a set of regular expressions with n overlapping symbols (that can match to the same input character concurrently), the NFA can require O(n) computation per input character¸whereas the DFA can have a state transition table with O(2 n ) states. By exploiting the state convolvements during the SFA construction, an equivalent SFA reduces the computation complexity to O(p 2 /c 2 ) per input character while limiting the space requirement to O(p 2 × (n/p) c ) states, where c ≥ 1 is a small design constant. Although the problem of constructing the optimal (minimum-sized) SFA is shown to be NP-complete, we develop a greedy heuristic to quickly construct a near-optimal SFA in time and space quadratic in the number of states in the original NFA. We demonstrate our SFA construction using real-world regular expressions taken from the Snort IDS.

show abstract

Evaluating regular expression matching engines on network and general purpose processors

Cited by 47 publications

References 15 publications

Deep packet inspection with DFA-trees and parametrized language overapproximation

Deep packet inspection with DFA-trees and parametrized language overapproximation

A Lightweight Software Model for Signature-Based Application-Level Traffic Classification System

Space-time tradeoff in regular expression matching with semi-deterministic finite automata

Contact Info

Product

Resources

About