Regular expression matching method based on smart finite automaton (SFA)

Abstract

The invention discloses a regular expression matching method based on a smart finite automaton (SFA), which comprises the steps of: selecting a proper regular expression rule set; and constructing the SFA; respectively carrying out character string matching on each read test set by an SFA matching method, and carrying out statistics on matching results. Experiment results indicate that: compared with an XFA (Xml Forms Architecture), the SFA has storage space overhead reduced by 44.1 percent, storage access frequency reduced by 69.1 percent and improved space-time efficiency of matching the regular expression. According to the invention, the problem of redundancy mobility edge existing in the XFA is solved, storage space can be effectively saved, and performances of the XFA are improved. Under the environment that the current network bandwidth and the traffic flow rapidly increase, the regular expression matching method provides an effective solution scheme for throughput requirements and storage space demands of line speed data packet processing during application.

Description

technical field [0001] The invention relates to electronic computer network technology, in particular to a regular expression matching method based on an intelligent limited automaton. Background technique [0002] Network Intrusion Detection and Prevention Systems (NIDS / NIPS) is an important means of network security defense, that is, by monitoring network traffic in real time, checking the header information and payload of each data packet (that is, the content of the data packet) , to identify and block suspicious behavior on the network. The core of NIDS / NIPS is Deep Packet Inspection (DPI), which uses a feature matching algorithm to match the content of each data packet with a set of predefined features. DPI technology is not only applied to NIDS / NIPS, but also applied to application layer data packet classification, P2P traffic identification, content-based traffic billing, etc. [0003] Feature matching algorithms can be divided into string matching algorithms and r...

AI Technical Summary

Problems solved by technology

When the string abcdabcdabcdefgh is read in, the state transition sequence of XFA is 0→1→2→3→4→1→2→3→4→1→2→3→4→5→6→7→8, where the state 1, 2, 3 and 4 appear repeatedly three times; when reaching state 3 for the first time, the auxiliary variable Bit1 is set to 1, indicating that the string abcd has been partially matched, and the subsequent string efgh is waiting; because XFA does not judge the auxiliary variable Bit1 Whether it is set or not, XFA needs to migrate unnecessary state, resulting in additional overhead such as memory access times and state lookups

The root cause of unnecessary state transitions is that XFA has redundant failover edges (see Figure 5 and Image 6 The dotted migration edge shown in ), does not determine whether the auxiliary variable is set

Images