![Page 1: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/1.jpg)
1
Regular expression matching with input compression : a hardware
design for use within network intrusion detection systems
Department of Computer Science and Information Engineering National Cheng Kung University, Taiwan R.O.C.
Authors: Gerald Tripp
Publisher: Journal in Computer Virology, 19 March 2007
Present: Yu-Tso Chen
Date: November, 22, 2007
![Page 2: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/2.jpg)
2
Outline
1. Introduction 2. Definitions and problem description 3. Matching of Individual Patterns 4. Selective Grouping of Multiple
Patterns 5. Evaluation Result 6. Conclusion
![Page 3: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/3.jpg)
3
Introduction
Build a table based automata implement-ation but to use a form of input compression
The table based approach allow the system to be dynamically updated at run time
The input compression helps to make significant reductions in the automata memory requirements.
![Page 4: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/4.jpg)
4
Outline
1. Introduction 2. Definitions and problem
description 3. Matching of Individual Patterns 4. Selective Grouping of Multiple
Patterns 5. Evaluation Result 6. Conclusion
![Page 5: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/5.jpg)
5
Definitions and problem description
Simple table based implementations can require quite a lot of memory resources• REs themselves that often create automata wi
th more node (and edges)
• Tables required for implementing automata can have a high level of redundancy
![Page 6: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/6.jpg)
6
Definitions and problem description (cont.)
For a Mealy machine, the amount of memory M in bits for a DFA with s states, i input bits and o output bits
![Page 7: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/7.jpg)
7
Outline
1. Introduction 2. Definitions and problem description 3. Regular expression
implementation 4. Input compression 5. Evaluation Result
![Page 8: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/8.jpg)
8
Packed array DFA implementation
![Page 9: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/9.jpg)
9
Packed transition tables
![Page 10: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/10.jpg)
10
Packed transition tables
![Page 11: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/11.jpg)
11
Outline
1. Introduction 2. Definitions and problem description 3. Regular expression implementation 4. Input compression 5. Evaluation Result
![Page 12: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/12.jpg)
12
Input compression
Esn as the set of characters enabling the edge or edges between current state s and next state n
Complete set of edge sets Pa
Pa gives us the sets of characters that we are interested in for all DFA edges.• These sets may however have overlaps
![Page 13: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/13.jpg)
13
Input compression
Pd is a set of disjoint sets of input characters
![Page 14: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/14.jpg)
14
Example
![Page 15: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/15.jpg)
15
Example (cont.)
![Page 16: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/16.jpg)
16
Outline
1. Introduction 2. Definitions and problem description 3. Regular expression implementation 4. Input compression 5. Evaluation Result
![Page 17: Department of Computer Science and Information Engineering](https://reader031.vdocuments.us/reader031/viewer/2022032605/56812c26550346895d9095e2/html5/thumbnails/17.jpg)
17
Evaluation Result