Finite State Machine Parsing for Internet Protocols: Faster Than You Think

Abstract

Abstract-A parser's job is to take unstructured, opaque data and convert it to a structured, semantically meaningful format. As such, parsers often operate at the border between untrusted data sources (e.g., the Internet) and the soft, chewy center of computer systems, where performance and security are paramount. A firewall, for instance, is precisely a trust-creating parser for Internet protocols, permitting valid packets to pass through and dropping or actively rejecting malformed packets. Despite the prevalence of finite state machines (FSMs) in both protocol specifications and protocol implementations, they have gained little traction in parser code for such protocols. Typical reasons for avoiding the FSM computation model claim poor performance, poor scalability, poor expressibility, and difficult or time-consuming programming.In this research report, we present our motivations for and designs of finite state machines to parse a variety of existing Internet protocols, both binary and ASCII. Our hand-written parsers explicitly optimize around L1 cache hit latency, branch misprediction penalty, and program-wide memory overhead to achieve aggressive performance and scalability targets. Our work demonstrates that such parsers are, contrary to popular belief, sufficiently expressive for meaningful protocols, sufficiently performant for high-throughput applications, and sufficiently simple to construct and maintain. We hope that, in light of other research demonstrating the security benefits of such parsers over more complex, Turing-complete codes, our work serves as evidence that certain "practical" reasons for avoiding FSM-based parsers are invalid.

Privacy-preserving Medical Treatment System through Nondeterministic Finite Automata

“…BASED ON NFA DFA and NFA can be leveraged as the modeling tool for many other applications: pattern matching [27], search on genome [10], [28], internet protocol parsing [29], deep packet inspection [30], [32], regular expressions search [31], [32], etc. Here, we focus on privacy-preserving NFA based errortolerant gene matching (P-Gene).…”

A New Multi-threaded and Interleaving Approach to Enhance String Matching for Intrusion Detection Systems

“…String matching algorithms form an important class of algorithms in computer science. They are critical in applications such as network intrusion detection systems [1,2,3,4], information retrieval [5], text editing applications [6], searching for records with state values in database systems [7,8], spell-checkers [9], DNA sequence mapping [10], virus scanning [11], IP (Internet Protocol) lookup [12], and protocol parsers [13]. Applications use either exact or approximate string matching.…”