In EDS ansehen

A Memory Efficient Pattern Matching Scheme for Regular Expressions.

Gespeichert in:
Bibliographische Detailangaben
Titel: A Memory Efficient Pattern Matching Scheme for Regular Expressions.
Autoren: Chang, Yeim-Kuan1 ykchang@mail.ncku.edu.tw, Shih, Ching-Hsuan1
Quelle: Procedia Computer Science. 2017, Vol. 110, p250-257. 8p.
Schlagwörter: Malware prevention, Internet traffic, Finite state machines, Computer network security, Kleene algebra
Abstract: Many malicious packets are common and spread over the Internet in recent years when the scale of Internet traffic grows at a rapid speed. Thus, the regular expression matching in Network Intrusion Detection System (NIDS) that supervises network activities needs to be very fast and consume small memory. In this paper, we propose a memory efficient regular expression matching algorithm called Failureless Segmented Finite Automata (FSFA) with an acceptable searching speed. In FSFA, We eliminate Kleene closures by using additional data structures to reduce a large amount of states. We further reduce the transitions by using default state compression technique. Our performance results implemented on a PC software environment show that our scheme only needs 1% of states needed in DFA and 2 to 22% of states needed in JFA. [ABSTRACT FROM AUTHOR]
Datenbank: Supplemental Index
Beschreibung
Abstract:Many malicious packets are common and spread over the Internet in recent years when the scale of Internet traffic grows at a rapid speed. Thus, the regular expression matching in Network Intrusion Detection System (NIDS) that supervises network activities needs to be very fast and consume small memory. In this paper, we propose a memory efficient regular expression matching algorithm called Failureless Segmented Finite Automata (FSFA) with an acceptable searching speed. In FSFA, We eliminate Kleene closures by using additional data structures to reduce a large amount of states. We further reduce the transitions by using default state compression technique. Our performance results implemented on a PC software environment show that our scheme only needs 1% of states needed in DFA and 2 to 22% of states needed in JFA. [ABSTRACT FROM AUTHOR]
ISSN:18770509
DOI:10.1016/j.procs.2017.06.092