Publication Details
Methodology for Fast Pattern Matching by Deterministic Finite Automaton with Perfect Hashing
Kořenek Jan, doc. Ing., Ph.D. (DCSY FIT BUT)
Lengál Ondřej, Ing., Ph.D. (FIT BUT)
Intrusion detection, regular expression, perfect hashing, hardware acceleration
As the speed of current computer networks increases,
it is necessary to protect networks by security systems
such as firewalls and Intrusion Detection Systems operating
at multigigabit speeds. Pattern matching is the time-critical
operation of current IDS on multigigabit networks. Regular
expressions are often used to describe malicious network patterns.
This paper deals with fast regular expression matching using
the Deterministic Finite Automaton (DFA) with perfect hash
function. We introduce decomposition of the problem on two
parts: transformation of the input alphabet and usage of a fast
DFA, and usage of perfect hashing to reduce space/speed tradeoff
for DFA transition table
As the speed of current computer networks increases,
it is necessary to protect networks by security systems
such as firewalls and Intrusion Detection Systems operating
at multigigabit speeds. Pattern matching is the time-critical
operation of current IDS on multigigabit networks. Regular
expressions are often used to describe malicious network patterns.
This paper deals with fast regular expression matching using
the Deterministic Finite Automaton (DFA) with perfect hash
function. We introduce decomposition of the problem on two
parts: transformation of the input alphabet and usage of a fast
DFA, and usage of perfect hashing to reduce space/speed tradeoff
for DFA transition table
@INPROCEEDINGS{FITPUB9054,
author = "Jan Ka\v{s}til and Jan Ko\v{r}enek and Ond\v{r}ej Leng\'{a}l",
title = "Methodology for Fast Pattern Matching by Deterministic Finite Automaton with Perfect Hashing",
pages = "823--289",
booktitle = "12th EUROMICRO Conference on Digital System Design DSD 2009",
year = 2009,
location = "Patras, GR",
publisher = "IEEE Computer Society",
ISBN = "978-0-7695-3782-5",
language = "czech",
url = "https://www.fit.vut.cz/research/publication/9054"
}