Algorithms to accelerate multiple regular expressions matching for deep packet inspection

There is a growing demand for network devices capable of examining the content of data packets in order to improve network security and provide application-specific services. Most high performance systems that perform deep packet inspection implement simple string matching algorithms to match packets against a large, but finite set of strings. However, there is growing interest in the use of regular expression-based pattern matching, since regular expressions offer superior expressive power and flexibility. Deterministic finite automata (DFA) representations are typically used to implement regular expressions. However, DFA representations of regular expression sets arising in network applications require large amounts of memory, limiting their practical application. In this paper, we introduce a new representation for regular expressions, called the Delayed Input DFA (D2 FA), which substantially reduces space requirements as compared to a DFA. A D2 FA is constructed by transforming a ...

• Type: Conference
• Year: 2006
• Where: SIGCOMM
• Authors: Sailesh Kumar, Sarang Dharmapurikar, Fang Yu, Patrick Crowley, Jonathan S. Turner
• Keywords: D2 FA, Deep Packet Inspection, Regular Expressions, SIGCOMM 2006