Fast regular expression matching using small TCAM

IEEE/ACM Transactions on Networking

Volumn 22, Issue 1, 2014, Pages 94-109

  Meiners, Chad R ^a,b   Patel, Jignesh ^c   Norige, Eric ^c   Liu, Alex X ^c,d   Torng, Eric ^c  

^a MICHIGAN STATE UNIVERSITY   (United States)

^b MIT LINCOLN LABORATORY   (United States)

^c Michigan State University   (United States)

^d NANJING UNIVERSITY   (China)

Author keywords

Deep packet inspection; Information security; Intrusion detection; Regular expression matching; Security; Ternary content addressable memory (TCAM)

Indexed keywords

EID: 84894719248     PISSN: 10636692     EISSN: None     Source Type: Journal    
DOI: 10.1109/TNET.2013.2256466     Document Type: Article

References (28)

1. R. Sommer and V. Paxson, "Enhancing byte-level network intrusion detection signatures with context," in Proc. ACM Conf. Comput. Commun. Security, 2003, pp. 262-271. (Pubitemid 40673808)
2. B. C. Brodie, D. E. Taylor, and R. K. Cytron, "A scalable architecture for high-throughput regular-expression patternmatching," in Proc. 33rd ISCA, 2006.
3. M. Becchi and P. Crowley, "An improved algorithm to accelerate regular expression evaluation," in Proc. ACM/IEEE ANCS, 2007, pp. 145-154.
4. B. C. Brodie,D. E. Taylor, andR.K. Cytron, "Efficient regular expression evaluation: Theory to practice," in Proc. ACM/IEEE ANCS, 2008, pp. 50-59.
5. S. Kumar, S. Dharmapurikar, F. Yu, P. Crowley, and J. Turner, "Algorithms to accelerate multiple regular expressions matching for deep packet inspection," in Proc. SIGCOMM, 2006, pp. 339-350. (Pubitemid 44623739)
6. S. Kumar, J. Turner, and J. Williams, "Advanced algorithms for fast and scalable deep packet inspection," in Proc. ANCS, 2006, pp. 81-92. (Pubitemid 47209676)
7. M. Becchi and S. Cadambi, "Memory-efficient regular expression search using state merging," in Proc. IEEE INFOCOM, 2007, pp. 1064-1072. (Pubitemid 47334328)
8. S. Kong, R. Smith, and C. Estan, "Efficient signature matching with multiple alphabet compression tables," in Proc. ACM SecureComm, 2008, Art. no. 1.
9. M. Becchi and P. Crowley, "A hybrid finite automaton for practical deep packet inspection," in Proc. CoNext, 2007, Art. no. 1.
10. J. E. Hopcroft, "An nlogn algorithm for minimizing the states in a finite automaton," in The Theory ofMachines and Computations. New York, NY, USA: Academic, 1971, pp. 189-196.
11. B. Agrawal and T. Sherwood, "Modeling TCAM power for next generation network devices," in Proc. IEEE Int. Symp. Perform. Anal. Syst. Softw., 2006, pp. 120-129. (Pubitemid 44711116)
12. M. Becchi and P. Crowley, "Extending finite automata to efficiently match Perl-compatible regular expressions," in Proc. CoNEXT, 2008, Art. no. 25.
13. A. V. Aho and M. J. Corasick, "Efficient string matching: An aid to bibliographic search," Commun. ACM, vol. 18, no. 6, pp. 333-340, 1975.
14. F. Yu, R. H. Katz, and T. V. Lakshman, "Gigabit rate packet patternmatching using TCAM," in Proc. 12th IEEE ICNP, 2004, pp. 174-183. (Pubitemid 40574708)
15. J.-S. Sung, S.-M. Kang, Y. Lee, T.-G. Kwon, and B.-T. Kim, "A multigigabit rate deep packet inspection algorithm using TCAM," in Proc. IEEE GLOBECOM, 2005, pp. 453-457. (Pubitemid 46171180)
16. M. Alicherry, M. Muthuprasanna, and V. Kumar, "High speed pattern matching for network IDS/IPS," in Proc. IEEE ICNP, 2006, pp. 187-196.
17. R. Smith, C. Estan, and S. Jha, "XFA: Faster signature matching with extended automata," in Proc. IEEE Symp. Security Privacy, 2008, pp. 187-201.
18. A. Bremler-Barr, D. Hay, and Y. Koral, "CompactDFA: Generic state machine compression for scalable pattern matching," in Proc. IEEE INFOCOM, 2010, pp. 659-667.
19. T. Liu, Y. Yang, Y. Liu, Y. Sun, and L. Guo, "An efficient regular expressions compression algorithm from a new perspective," in Proc. IEEE INFOCOM, 2011, pp. 2129-2137.
20. F. Yu, Z. Chen, Y. Diao, T. V. Lakshman, and R. H. Katz, "Fast and memory-efficient regular expression matching for deep packet inspection," in Proc. ACM/IEEE ANCS, 2006, pp. 93-102. (Pubitemid 47209677)
21. R. Smith, C. Estan, S. Jha, and S. Kong, "Deflating the big bang: Fast and scalable deep packet inspection with extended finite automata," in Proc. SIGCOMM, 2008, pp. 207-218.
22. S. Kumar, B. Chandrasekaran, J. Turner, and G. Varghese, "Curing regular expressions matching algorithms from insomnia, amnesia, and acalculia," in Proc. ACM/IEEE ANCS, 2007, pp. 155-164.
23. J. Moscola, J. Lockwood, R. P. Loui, and M. Pachos, "Implementation of a content-scanning module for an internet firewall," in Proc. IEEE Field Program. Custom Comput. Mach., 2003, pp. 31-38.
24. S. Suri, T. Sandholm, and P. Warkhede, "Compressing two-dimensional routing tables," Algorithmica, vol. 35, pp. 287-300, 2003.
25. C. R. Meiners, A. X. Liu, and E. Torng, "TCAM Razor: A systematic approach towards minimizing packet classifiers in TCAMs," in Proc. 15th IEEE Conf. Netw. Protocols, Oct. 2007, pp. 266-275.
26. D. E. Knuth, "Huffman's algorithm via algebra," J. Combin. Theory, Ser. A, vol. 32, no. 2, pp. 216-224, 1982.
27. C. R. Meiners, A. X. Liu, and E. Torng, "Bit weaving: A non-prefix approach to compressing packet classifiers in TCAMs," in Proc. 17th IEEE ICNP, Oct. 2009, pp. 93-102.
28. M. Becchi, M. Franklin, and P. Crowley, "A workload for evaluating deep packet inspection architectures," in Proc. IEEE IISWC, 2008, pp. 78-89.