Regular expression matching with input compression: a hardware design for use within network intrusion detection systems

Abstract

This paper describes an optimised finite state automata based hardware design for implementing high speed regular expression matching. Automata based implementations of regular expression matching can become quite complex and if table driven can use large amounts of memory—this can be a problem for hardware based implementations, as the amount of memory available within standard Field Programmable Gate Array (FPGA) components can be quite small as compared with the amount of resources we expect to find within a software environment. This work uses an existing ‘packed array’ style of table based automata implementation, but then adds a form of input compression to group together characters that are treated identically by the automata. A hardware design for such a system has been created for use within a Xilinx Field Programmable Gate Array and tested by simulation. The design operates at a fixed scan rate of 2.0 Gbps independent of the regular expression used or the input data being scanned. The regular expression rules are first compiled by software and then loaded into the design at run time and may be updated dynamically without modification to the design.