A hybrid finite automaton for practical deep packet inspection

Abstract

Deterministic finite automata (DFAs) are widely used to perform regular expression matching in linear time. Several techniques have been proposed to compress DFAs in order to reduce memory requirements. Unfortunately, many realworld IDS regular expressions include complex terms that result in an exponential increase in number of DFA states. Since all recent proposals use an initial DFA as a startingpoint, they cannot be used as comprehensive regular expression representations in an IDS.In this work we propose a hybrid automaton which addresses this issue by combining the benefits of deterministic and non-deterministic finite automata. We test our proposal on Snort rule-sets and we validate it on real traffic traces. Finally, we address and analyze the worst case behavior of our scheme and compare it to traditional ones.

A Heuristic for Constructing Smaller Automata Based on Suffix Sorting and Its Application in Network Security

“…Then we look at the improvement from using the new NFA over a normal NFA, or a Hybrid Finite Automata (HFA) [3]. In particular we look at automata size and and matching efficiency as a measure of throughput.…”

“…The main merit of our approach is that it can be used with any previous approach for faster intrusion detection, be it based on the hardware [9] or the software [3]. Also it is simple and easy to implement.…”

“…If we build a smaller automata for the whole language that fits into the cache, then we will obtain better throughputs. Works on intrusion detection systems focus on obtaining better throughputs by hardware-based approaches (for example, using graphical processors as in [9]) or by software-based ones (for example, Hybrid Finite Automata [3]). …”

Optimizing Regular Expression Matching with SR-NFA on Multi-Core Systems

“…In [12], a regex is split into a prefix and a suffix to avoid or reduce state explosion in the prefix part. A similar technique was also used in [6] to partition multiple regexes into a head-DFA plus individual tail-NFAs. Both of these works relied on the NFA-to-DFA conversion and various DFA compression techniques to implement REM on sharedmemory multi-core architectures.…”

A Memory Efficient Regular Expression Matching by Compressing Deterministic Finite Automata

“…The total number of states in DFA was reduced by the approaches like Hybrid DFA-NFA, HFA and XFA. The hybrid DFA-NFA [5] has reduced number of states by merging the advantages of both automata DFA and Nondeterministic finite automata (NFA) [5]. The nodes that have state explosion problem were represented by NFA and for lasting nodes a DFA was used.…”