170 likes | 370 Vues
Regular expression matching with input compression : a hardware design for use within network intrusion detection systems. Authors: Gerald Tripp Publisher: Journal in Computer Virology, 19 March 2007 Present: Yu-Tso Chen Date: November, 22, 2007.
E N D
Regular expression matching with input compression:a hardware design for use within network intrusion detection systems Authors: Gerald Tripp Publisher: Journal in Computer Virology, 19 March 2007 Present:Yu-Tso Chen Date:November, 22, 2007 Department of Computer Science and Information Engineering National Cheng Kung University, Taiwan R.O.C.
Outline • 1. Introduction • 2. Definitions and problem description • 3. Matching of Individual Patterns • 4. Selective Grouping of Multiple Patterns • 5. Evaluation Result • 6. Conclusion
Introduction • Build a table based automata implement-ation but to use a form of input compression • The table based approach allow the system to be dynamically updated at run time • The input compression helps to make significant reductions in the automata memory requirements.
Outline • 1. Introduction • 2. Definitions and problem description • 3. Matching of Individual Patterns • 4. Selective Grouping of Multiple Patterns • 5. Evaluation Result • 6. Conclusion
Definitions and problem description • Simple table based implementations can require quite a lot of memory resources • REs themselves that often create automata with more node (and edges) • Tables required for implementing automata can have a high level of redundancy
Definitions and problem description (cont.) • For a Mealy machine, the amount of memory M in bits for a DFA with s states, i input bits and o output bits
Outline • 1. Introduction • 2. Definitions and problem description • 3. Regular expression implementation • 4. Input compression • 5. Evaluation Result
Outline • 1. Introduction • 2. Definitions and problem description • 3. Regular expression implementation • 4. Input compression • 5. Evaluation Result
Input compression • Esn as the set of characters enabling the edge or edges between current state s and next state n • Complete set of edge sets Pa • Pa gives us the sets of characters that we are interested in for all DFA edges. • These sets may however have overlaps
Input compression • Pd is a set of disjoint sets of input characters
Outline • 1. Introduction • 2. Definitions and problem description • 3. Regular expression implementation • 4. Input compression • 5. Evaluation Result