LaFA: lookahead finite automata for scalable regular expression detection

Although Regular Expressions (RegExes) have been widely used in network security applications, their inherent complexity often limits the total number of RegExes that can be detected using a single chip for a reasonable throughput. This limit on the number of RegExes impairs the scalability of today's RegEx detection systems. The scalability of existing schemes is generally limited by the traditional per character state processing and state transition detection paradigm. The main focus of existing schemes is in optimizing the number of states and the required transitions, but not the suboptimal character-based detection method. Furthermore, the potential benefits of reduced number of operations and states using out-of-sequence detection methods have not been explored. In this paper, we propose Lookahead Finite Automata (LaFA) to perform scalable RegEx detection using very small amount of memory. LaFA's memory requirement is very small due to the following three areas of effo...

• Type: Journal
• Year: 2009
• Where: ANCS
• Authors: Masanori Bando, N. Sertac Artan, H. Jonathan Chao
• Keywords: ANCS 2009, Computer Networks, Detection, Regex, RegEx Detection