StriD²FA: Scalable Regular Expression Matching for Deep Packet Inspection
Xiaofei Wang, Junchen Jiang, Yi Tang, Bin Liu, Xiaojun Wang · 2011
Deep packet inspection (DPI) has become one of the key components of a Network Intrusion Detection System (NIDS) and it compares packet content to a set of rules written in regular expression. The need to keep up with ever-increasing line speed has forced NIDS designers to move to hardware or high-speed memory where memory resources are limited. In this paper, we present LBM, a novel accelerating scheme for regular expression matching which converts the original byte stream into much shorter integer stream and then matches it with a variant of DFA, called StriD2FA. In the instance of LBM that we realize, 10 to 15 speedup is reasonable while the memory is much smaller than traditional DFA.