Hybrid Regular Expression Matching for Deep Packet Inspection on Multi-Core Architecture

Abstract

Many network security applications in today's networks are based on deep packet inspection, checking not only the header portion but also the payload portion of a packet. For example, traffic monitoring, layer-7 filtering, and network intrusion detection all require an accurate analysis of packet content in search for predefined patterns to identify specific classes of applications, viruses, attack signatures, etc. Regular expressions are often used to represent such patterns. They are implemented using finite automata, which take the payload of a packet as an input string. However, existing approaches, both non-deterministic finite automata (NFA) and deterministic finite automata (DFA), have limitations; NFAs have excessive time complexity while DFAs have excessive space complexity. In this paper, we propose an efficient algorithm for regular expression matching to implement deep packet inspection on multi-core architecture. A regular expression is split into NFAfriendly components and DFA-friendly components, which are then assigned to different cores. This hybrid method combines the merits of NFA and DFA implementations, and efficiently takes advantage of multi-core architecture. We evaluate our algorithm using rule sets provided by Snort, a popular opensource intrusion detection system. The simulation results show that our approach outperforms existing NFA/DFA and hybrid approaches. Furthermore, our algorithm performs well on the important issues on multi-core architecture design, such as load balancing, data locality and communication between cores.

Modern ağ trafiği analizi için derin paket incelemesi hakkında kapsamlı bir çalışma: sorunlar ve zorluklar

“…The software-based methods using general-purpose processors provide greater flexibility and programmability compared with the hardware-based solutions. In the studies numbered [121,122] and [123], approaches that combine the advantages of NFA and DFA applications are proposed in order to benefit from multi-core architectures efficiently. It is aimed to increase the matching performance by using the existing parallelism provided by multi-core processors with the algorithm proposed in the study numbered [121] in which complex REs are divided and assigned to different cores.…”

“…In the studies numbered [121,122] and [123], approaches that combine the advantages of NFA and DFA applications are proposed in order to benefit from multi-core architectures efficiently. It is aimed to increase the matching performance by using the existing parallelism provided by multi-core processors with the algorithm proposed in the study numbered [121] in which complex REs are divided and assigned to different cores. In the study numbered [122], a new pattern matching algorithm HBM is proposed by combining DFA and NFA.…”

Parallel Finite State Machines for Very Fast Distributable Regular Expression Matching

“…Furthermore, when some regular expressions are expressed as NFAs in order to save memory, it is possible to distribute both NFA and DFA regular expressions among processors in such a way that memory use and processing time is balanced in each processor, as proposed in (Sun et al, 2010).…”

Treating Insomnia, Amnesia, and Acalculia in Regular Expression Matching

“…Furthermore, when some regular expressions are expressed as NFAs in order to save memory, it is possible to distribute both NFA and DFA regular expressions among processors in such a way that memory use and processing time is balanced in each processor, as proposed in [18].…”