Regular Expression Matching with Multi-Strings and Intervals

Bille, Philip; Thorup, Mikkel

doi:10.1137/1.9781611973075.104

Cited by 31 publications

(25 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Note the dashed prev arrows emanating from inter [3,8] and from inter [3,6] to inter [1,2]. Due to the lack of information in inter [2,5], which is the entry of the immediate ancestors of [3,8] and [3,6], their prev links are directed to the entry inter [2,5].prev refers to.…”

Section: Intersection By Lookup Tablementioning

confidence: 99%

Dictionary matching with a few gaps

Amir

Levy

Porat

et al. 2015

Theoretical Computer Science

View full text Add to dashboard Cite

The dictionary matching with gaps problem is to preprocess a dictionary D of total size |D| containing d gapped patterns P 1 , . . . , P d over an alphabet Σ, where each gapped pattern P i is a sequence of subpatterns separated by bounded sequences of don't cares. Then, given a query text T of length n over Σ, the goal is to output all locations in T in which a pattern P i ∈ D, 1 ≤ i ≤ d, ends. There is a renewed current interest in the gapped matching problem stemming from cyber security. In this paper we solve the problem where all patterns in the dictionary have one gap or a few gaps with at least α and at most β don't cares, where α and β are given parameters. Specifically, we show that the dictionary matching with a single gap problem can be solved in either O (d log d + |D|) preprocessing time and O (d log ε d + |D|) space, and query time O (n(β − α) log log d log 2 |D| + occ), where occ is the number of patterns found, or preprocessing time and space: O (d 2 + |D|), and query time O (n(β − α) + occ), where occ is the number of patterns found. We also show that the dictionary matching with k gaps problem, where k ≥ 1, can be solved in preprocessing time: O (|D| log |D|), space: O (|D| + d (c 1 log d) k k! ), and query time:O ((β − α) k (n + (c 2 log d) k k! log log |D|) + occ), where c 1 , c 2 > 1 are constants and occ is the number of patterns found. As far as we know, these are the best solutions for this setting of the problem, where many overlaps may exist in the dictionary.

show abstract

Section: Intersection By Lookup Tablementioning

confidence: 99%

Dictionary matching with a few gaps

Amir

Levy

Porat

et al. 2015

Theoretical Computer Science

View full text Add to dashboard Cite

show abstract

“…Efforts in this area has focused on rewriting signatures and grouping schemes (e.g., [23]), narrowing regular expression definitions (e.g., [6]), or utilizing hardwarebased methods (e.g., [24]). …”

Section: Related Workmentioning

confidence: 99%

CUTE: Traffic Classification Using TErms

Yeganeh

Eftekhar

Ganjali

et al. 2012

2012 21st International Conference on Computer Communications and Networks (ICCCN)

View full text Add to dashboard Cite

Among different traffic classification approaches, Deep Packet Inspection (DPI) methods are considered as the most accurate. These methods, however, have two drawbacks: (i) they are not efficient since they use complex regular expressions as protocol signatures, and (ii) they require manual intervention to generate and maintain signatures, partly due to the signature complexity.In this paper, we present CUTE, an automatic traffic classification method, which relies on sets of weighted terms as protocol signatures. The key idea behind CUTE is an observation that, given appropriate weights, the occurrence of a specific term is more important than the relative location of terms in a flow. This observation is based on experimental evaluations as well as theoretical analysis, and leads to several key advantages over previous classification techniques: (i) CUTE is extremely faster than other classification schemes since matching flows with weighed terms is significantly faster than matching regular expressions; (ii) CUTE can classify network traffic using only the first few bytes of the flows in most cases; and (iii) Unlike most existing classification techniques, CUTE can be used to classify partial (or even slightly modified) flows. Even though CUTE replaces complex regular expressions with a set of simple terms, using theoretical analysis and experimental evaluations (based on two large packet traces from tier-one ISPs), we show that its accuracy is as good as or better than existing complex classification schemes, i.e. CUTE achieves precision and recall rates of more than 90%. Additionally, CUTE can successfully classify more than half of flows that other DPI methods fail to classify.

show abstract

“…Further not so well known measures for the complexity of regular expressions can be found in [7,16,17,32]. To our knowledge, these latter measures received far less attention to date.…”

Section: Introductionmentioning

confidence: 99%

The Complexity of Regular(-Like) Expressions

Holzer

Kutrib

2011

Int. J. Found. Comput. Sci.

View full text Add to dashboard Cite

We summarize results on the complexity of regular(-like) expressions and tour a fragment of the literature. In particular we focus on the descriptional complexity of the conversion of regular expressions to equivalent finite automata and vice versa, to the computational complexity of problems on regular-like expressions such as, e.g., membership, inequivalence, and non-emptiness of complement, and finally on the operation problem measuring the required size for transforming expressions with additional language operations (built-in or not) into equivalent ordinary regular expressions.

show abstract

Regular Expression Matching with Multi-Strings and Intervals

Cited by 31 publications

References 24 publications

Dictionary matching with a few gaps

Dictionary matching with a few gaps

CUTE: Traffic Classification Using TErms

The Complexity of Regular(-Like) Expressions

Contact Info

Product

Resources

About