Parallel NFA Pattern Matching for Network Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network attack detection techniques using pattern matching are inefficient due to sequential processing of network traffic, which hampers the accuracy and speed of identifying security threats in enterprise computer networks.
Innovation Solution
The use of non-deterministic finite automata (NFA) representations to evaluate symbol streams in parallel, allowing for concurrent evaluation of multiple states and symbols, thereby enhancing the detection of network attacks and security threats by utilizing a hardware-based pattern matching module with node vectors and threads to identify patterns defined by regular expressions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If conventional sequential pattern matching is used to detect network attacks, then the detection accuracy can be maintained, but the processing speed and efficiency are insufficient
Solution Approach 1:
The patent divides the pattern matching process into multiple independent threads, each responsible for evaluating specific nodes in the NFA representation. This segmentation allows parallel processing of different portions of the symbol stream, significantly improving processing speed while maintaining detection accuracy through coordinated thread execution.
Solution Approach 2:
The patent transitions from sequential single-threaded processing to multi-dimensional parallel processing by utilizing multiple hardware threads simultaneously evaluating different NFA nodes. This dimensional shift from time-sequential to space-parallel execution resolves the contradiction between speed and productivity.
2Reliability
If multiple patterns are used to detect different types of attacks, then the accuracy and robustness of attack detection are improved, but the complexity of the detection system increases
Solution Approach 1:
The patent creates a universal hardware-based pattern matching module that can simultaneously evaluate multiple regular expression patterns through parallel thread execution. Each thread handles specific patterns while sharing common NFA evaluation infrastructure, achieving multi-pattern detection capability without proportionally increasing system complexity.
Solution Approach 2:
The patent merges multiple pattern evaluation functions into a single unified hardware module that processes multiple patterns concurrently. By combining pattern matching, NFA evaluation, and thread coordination into one integrated system, the patent reduces overall system complexity while maintaining high detection accuracy across multiple attack types.
3Productivity
If parallel evaluation of NFA states is implemented, then the processing speed and detection efficiency are improved, but the memory usage and resource consumption increase
Solution Approach 1:
The patent implements local quality optimization by having each thread maintain only the NFA node state information necessary for its specific evaluation task. Rather than duplicating entire NFA representations across all threads, each thread stores localized state data, reducing overall memory consumption while enabling parallel processing for high detection efficiency.
Data Source
AI summary
This disclosure describes techniques of determining whether a symbol stream includes a pattern defined by a regular expression. As described herein, the regular expression may be represented using a non-deterministic finite automaton (NFA). A plurality of states in the NFA may be evaluated in parallel. These states may be associated with a plurality of symbol positions in a symbol stream. Evaluating a plurality of states and symbols in parallel may allow for faster determinations of whether the symbol stream includes the pattern defined by the regular expression.