State Range Processing for Intrusion Prevention Regular Expressions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion prevention systems face inefficiencies in processing regular expressions due to the complexity of nondeterministic finite automata (NFAs), which require extensive backtracking, leading to performance issues in identifying signature data patterns within network traffic.
Innovation Solution
The implementation of state ranges and lambda transitions in a state-transition table allows for efficient evaluation of regular expressions by dynamically determining search ranges and optimizing state transitions, reducing the need for backtracking and improving processing speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If nondeterministic finite automata (NFAs) are used to process regular expressions, then the system can handle complex data patterns, but processing speed decreases due to extensive backtracking
Solution Approach 1:
The patent converts the static NFA state transitions into dynamic state ranges that adapt during processing. Instead of following fixed NFA paths that require backtracking, the system dynamically determines ranges of states to evaluate, allowing it to handle complex patterns while avoiding the speed penalty of exhaustive backtracking through the use of state range calculations and lambda transitions
2Quantity of substance
If traditional state machine processing is used, then memory usage is low, but processing time increases due to backtracking operations
Solution Approach 1:
The patent performs preliminary actions by pre-calculating state ranges and lambda transitions before actual pattern matching occurs. This preliminary preparation allows the system to quickly determine which states to evaluate during processing, eliminating the need for time-consuming backtracking operations while maintaining efficient memory usage through the compact state-transition table structure
3Speed
If regular expression processing is optimized for speed, then processing time decreases, but computational resource consumption increases
Solution Approach 1:
The patent applies local quality by optimizing only the specific portions of the state machine that are relevant to each pattern match. Instead of uniformly processing all states, the system calculates and evaluates only the local state ranges that are pertinent to the current matching context, achieving high processing speed while minimizing computational resource consumption through targeted, localized evaluation
Data Source
AI summary
Methods and systems are provided for using state ranges for processing regular expressions in intrusion-prevention systems. In an embodiment, in an intrusion-prevention system for examining network traffic and identifying therein the presence of signature data patterns, a state-transition table is provided. The state-transition table is representative of a predetermined data pattern, and includes states each having one or more egress events defining transitions to other states. A subject is received for evaluation for the presence of the predetermined data pattern. While using the state-transition table for said evaluation, the presence of a first egress event of a first state is detected in the subject, resulting in a transition from the first state to a second state. A second-state range in the subject is calculated, and the second-state range is searched for the presence of at least one of the second state's egress events.