Abstract

Regular expression matching plays an important role in modern Deep Packet Inspection (DPI) engines, to classify or filter packets by matching their payloads toward a series of pre-defined rules represented as regular expressions. Generally, finite automaton-based approaches are utilized to perform fast and scalable regular expression matching. Among those approaches, Deterministic Finite Automaton (DFA) has the fastest speed yet suffers from the state space explosion problem. By contrast, Nondeterministic Finite Automaton (NFA) can achieve the highest memory efficiency at the cost of complicated and thus low-speed matching process.Instead of seeking for a reasonable trade-off between memory efficiency and processing throughput from DFA, this paper chooses the NFA as the start point for optimization. Based on two important observations, a Multi-Stride Index (MSI) table is designed for pre-processing before going into the NFA. As the MSI table can filter most of unsuccessful matchings and thus significantly reduce the chance of processing on the NFA, the proposed MSI-NFA approach achieves a fast speed approximate to the DFA when processing real-world HTTP packets. As demonstrated in the experimental results, its speed is at most \(10\,\%\) lower than that of DFA. Moreover, the additional memory cost is as low as 20 KB compared with NFA.

Full Text
Paper version not known

Talk to us

Join us for a 30 min session where you can share your feedback and ask us any queries you have

Schedule a call

Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.