Extended Finite Automata for Deep Packet Inspection Memory Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep packet inspection in modern networking devices faces challenges in achieving high-speed processing due to the state space explosion problem with deterministic finite automata (DFAs) and inefficiencies with nondeterministic finite automata (NFAs), particularly in matching complex regular expressions for intrusion detection and prevention systems.
Innovation Solution
Extended Finite Automata (XFAs) are introduced, which use a small amount of 'scratch memory' to record progress in matching signatures, avoiding state space explosion and offering a balance between memory usage and processing speed by separating information into bits, counters, and other data structures, allowing for compact representation and efficient matching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If deterministic finite automata (DFAs) are used for signature matching, then processing speed is improved, but memory requirements become infeasibly large due to state space explosion
Solution Approach 1:
The patent segments the DFA into multiple smaller DFAs, each handling a subset of signatures. This segmentation reduces the state space of each individual DFA, making them feasible for implementation while maintaining the ability to match multiple signatures through coordinated operation of the segmented components.
Solution Approach 2:
The patent introduces a new dimension to the matching process by using multiple DFAs operating in parallel, each responsible for a specific subset of signatures. This dimensional approach allows the system to achieve both speed (through deterministic matching) and memory efficiency (through reduced individual state spaces).
2Quantity of substance
If nondeterministic finite automata (NFAs) are used for signature matching, then memory requirements are reduced, but processing speed becomes hundreds of times slower than DFAs
Solution Approach 1:
The patent segments the NFA into multiple smaller NFAs, each handling a subset of signatures. This segmentation reduces the computational overhead of NFA matching by limiting the number of states that need to be tracked simultaneously, thereby improving processing speed while maintaining memory efficiency.
Solution Approach 2:
The patent introduces a new dimension to the matching process by using multiple NFAs operating in parallel, each responsible for a specific subset of signatures. This dimensional approach allows the system to achieve both memory efficiency (through reduced state tracking) and improved speed (through parallel processing of segmented signature sets).
3Quantity of substance
If multiple DFAs are used to reduce state space explosion, then memory usage is improved, but the number of DFAs increases leading to more complex system management
Solution Approach 1:
The patent designs each DFA in the multiple-DFA system to be universal within its subset, using standardized structures and transition formats. This universality simplifies system management by allowing consistent handling of multiple DFAs through unified control mechanisms, reducing the complexity overhead despite having multiple automata.
Solution Approach 2:
The patent organizes multiple DFAs into a structured dimensional framework where each DFA operates in a specific dimension (subset of signatures). This organizational structure simplifies management by providing clear boundaries and responsibilities for each DFA, making the overall system more manageable despite the increased number of components.
Data Source
AI summary
Deterministic finite automata (DFAs) are popular solutions to deep packet inspection because they are fast and DFAs corresponding to multiple signatures are combinable into a single DFA. Combining such DFAs causes an explosive increase in memory usage. Extended finite automata (XFAs) are an alternative to DFAs that avoids state-space explosion problems. XFAs extend DFAs with a few bytes of “scratch memory” used to store bits and other data structures that record progress. Simple programs associated with automaton states and/or transitions manipulate this scratch memory. XFAs are deterministic in their operation, are equivalent to DFAs in expressiveness, and require no custom hardware support. Fully functional prototype XFA implementations show that, for most signature sets, XFAs are at least 10,000 times smaller than the DFA matching all signatures. XFAs are 10 times smaller and 5 times faster or 5 times smaller and 20 times faster than systems using multiple DFAs.