Pattern overlap in bit-parallel implementation of regular expression repetition quantifiers

Abstract

Deep Packet Inspection DPI in Network Intrusion Detection and Prevention Systems NIDPS typically involves the matching of packet payloads against attack signatures in the form of regular expressions regexes. Existing research into the handling of the constrained {min, max} repetition syntax used in many regexes mainly proposes the use of a counting mechanism which avoids inefficient unrolling of the repeated sub-expression. However, many regexes cannot be handled as their format makes them susceptible to the problem of counter overlap. In this paper, we present a memory-centric bit-parallel hardware architecture that overcomes the issue of counter overlap through the use of a bit serial First-In-First-Out FIFO queue. The memory-centric rather than logic-centric nature of the design has the advantage of allowing dynamic updates to individual attack signatures. The solution proposed in this paper is targeted at ASIC and FPGA platforms and we present experimental results for a proof-of-concept design.