TCAM-based DFA deflation: a novel approach to fast and scalable regular expression matching
Kunyang Peng,Qunfeng Dong,Min Chen +2 more
- pp 1-3
Reads0
Chats0
TLDR
Regular expression matching is the foundation of many network functions including intrusion detection, worm detection, traffic analysis and so on, where known patterns such as worm fingerprints are characterized using regular expressions and searched in network traffic for pattern match.Abstract:
Regular expression matching is the foundation of many network functions including intrusion detection, worm detection, traffic analysis and so on, where known patterns such as worm fingerprints are characterized using regular expressions and searched in network traffic for pattern match. As the quantity and diversity of known patterns keep increasing, regular expression pattern sets have rapidly grown in both size and complexity, while having to be matched in network traffic at accelerating wire speeds. Fast and scalable regular expression matching, therefore, is fundamental to the development of practical network systems.read more
Citations
More filters
Proceedings ArticleDOI
GPU-based NFA implementation for memory efficient high speed regular expression matching
TL;DR: This work proposes effective methods for fitting NFAs into GPU architecture through proper data structure and parallel programming design, so that GPU's parallel processing power can be better utilized to achieve high speed regular expression matching.
Proceedings ArticleDOI
Chain-Based DFA Deflation for Fast and Scalable Regular Expression Matching Using TCAM
TL;DR: A chain-based {DFA deflation} method for fast and scalable regular expression matching using TCAM, which takes one simple TCAM lookup to match each input character and effectively deflates DFA size is proposed.
Journal ArticleDOI
Algorithms to speedup pattern matching for network intrusion detection systems
TL;DR: This paper introduces the concept of negative pattern matching, by which it can splice flows into segments for fine-grained load balancing and optimized parallel speedup while ensuring correctness, and dramatically reduces the number of Ternary Content Addressable Memory (TCAM) lookups thus reducing the power consumption.
Journal ArticleDOI
GPU-based NFA implementation for memory efficient high speed regular expression matching
TL;DR: Regular expression pattern matching is the foundation and core engine of many network functions, such as network intrusion detection, worm detection, traffic analysis, web applications and so on.
Journal ArticleDOI
Multi-character cost-effective and high throughput architecture for content scanning
TL;DR: In this article, a method and corresponding hardware architecture for string matching is presented, which is composed of two main steps: the first step performs a pre-detection of signatures alignment, and in the second step the alignment is corrected and the signatures are detected by a matcher.
References
More filters
Journal ArticleDOI
Algorithms to accelerate multiple regular expressions matching for deep packet inspection
TL;DR: This paper introduces a new representation for regular expressions, called the Delayed Input DFA (D2FA), which substantially reduces space equirements as compared to a DFA, and describes an efficient architecture that can perform deep packet inspection at multi-gigabit rates.
Proceedings ArticleDOI
An improved algorithm to accelerate regular expression evaluation
Michela Becchi,Patrick Crowley +1 more
TL;DR: This paper introduces a general compression technique that results in at most 2N state traversals when processing a string of length N, and describes a novel alphabet reduction scheme for DFA-based structures that can yield further dramatic reductions in data structure size.
Proceedings ArticleDOI
XFA: Faster Signature Matching with Extended Automata
TL;DR: Extended finite automata (XFAs) are introduced which augment FSAs with finite scratch memory and instructions to manipulate this memory and achieve 20 times higher matching speeds than a DFA-based solution.
Proceedings Article
Fast regular expression matching using small TCAMs for network intrusion detection and prevention systems
TL;DR: This paper proposes the first hardware-based RE matching approach that uses Ternary Content Addressable Memories (TCAMs), which are off-the-shelf chips and have been widely deployed in modern networking devices for packet classification.