Algorithms to accelerate multiple regular expressions matching for deep packet inspection
Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications
Fast and memory-efficient regular expression matching for deep packet inspection
Proceedings of the 2006 ACM/IEEE symposium on Architecture for networking and communications systems
An improved algorithm to accelerate regular expression evaluation
Proceedings of the 3rd ACM/IEEE Symposium on Architecture for networking and communications systems
Efficient signature matching with multiple alphabet compression tables
Proceedings of the 4th international conference on Security and privacy in communication netowrks
| Hi-index | 0.00 |
Regular expression (Reg Ex) matching plays an important role in many modern intrusion detection systems (IDS). DFA is an effective way to perform regular expression matching. However, the prohibitive memory requirement makes DFAs impractical for many real world rule sets. In this paper we propose a method to dramatically reduce the DFA memory usage and still provide guaranteed matching speed. A small table for each state is employed to help translate the input character into the offset of the modified transition table for the same state. The proposed representation for DFAs is called character substitution DFA (CSDFA). We present experimental results using rule sets from both L7-filter and Snort.