Regex Compiler NFA to DFA Conversion for Router Pattern Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current networking systems face performance limitations in processing and securing high-level network protocols (L4-L7) due to insufficient memory and CPU resources in routers, leading to slow compilation of new patterns or signatures, which compromises security and packet inspection efficiency.
Innovation Solution
The method involves converting a nondeterministic finite automata (NFA) graph to a deterministic finite automata (DFA) graph, using hash values to compress and recognize patterns, thereby optimizing memory usage and processing speed for pattern matching in routers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a general purpose processor is used to process L4-L7 network protocols, then intelligent processing capability is improved, but processing speed deteriorates and cannot achieve wire-speed forwarding
Solution Approach 1:
The patent segments the pattern matching process into two distinct phases: compilation phase (converting regex patterns to NFA/DFA graphs) and execution phase (using the compiled graphs for packet inspection). This segmentation allows complex intelligent processing to be performed during compilation, while the execution phase uses optimized graph structures that can be efficiently processed by network processors at wire-speed.
Solution Approach 2:
The patent performs preliminary action by pre-compiling regular expressions into NFA and DFA graphs before packet inspection. The complex pattern compilation work is done in advance using general purpose processors, and the resulting graphs are then used by network processors for high-speed matching without needing to recompile patterns during packet processing.
2Adaptability or versatility
If new patterns or signatures are compiled on a router with limited memory and CPU resources, then local pattern recognition capability is improved, but compilation time increases and performance deteriorates compared to central server compilers
Solution Approach 1:
The patent uses copying by creating compact NFA and DFA graph representations of patterns that can be stored in limited router memory. Instead of storing full regex patterns or complex compilation artifacts, the system copies essential pattern information into optimized graph structures that consume less memory and can be quickly compiled even on routers with constrained resources.
Solution Approach 2:
The patent changes parameters by transforming patterns from a different representation (regex strings) into a new representation (NFA/DFA graphs with specific state and transition properties). This parameter transformation optimizes the patterns for both compilation efficiency and memory usage, enabling faster local compilation on routers while maintaining pattern matching accuracy.
3Reliability
If the entire alphabet set is used for pattern recognition, then pattern matching completeness is improved, but memory footprint increases
Solution Approach 1:
The patent extracts only the relevant portion of the alphabet set that is actually needed for pattern matching. Instead of allocating memory for all possible characters in the complete alphabet, the system identifies and extracts only those characters that appear in the patterns being monitored, creating a minimized alphabet representation that reduces memory footprint while maintaining complete pattern matching capability for the required patterns.
Data Source
AI summary
A method and corresponding apparatus relate to converting a nondeterministic finite automata (NFA) graph for a given set of patterns to a deterministic finite automata (DFA) graph having a number of states. Each of the DFA states is mapped to one or more states of the NFA graph. A hash value of the one or more states of the NFA graph mapped to each DFA state is computed. A DFA states table correlates each of the number of DFA states to the hash value of the one or more states of the NFA graph for the given pattern.