Fast and scalable regular expressions matching with multi-stride index NFA

Abstract

Regular expression matching plays an important role in modern Deep Packet Inspection (DPI) engines, to classify or filter packets by matching their payloads toward a series of pre-defined rules represented as regular expressions. Generally, finite automaton-based approaches are utilized to perform fast and scalable regular expression matching. Among those approaches, Deterministic Finite Automaton (DFA) has the fastest speed yet suffers from the state space explosion problem. By contrast, Nondeterministic Finite Automaton (NFA) can achieve the highest memory efficiency at the cost of complicated and thus low-speed matching process. Instead of seeking for a reasonable trade-off between memory efficiency and processing throughput from DFA, this paper chooses the NFA as the start point for optimization. Based on two important observations, a Multi-Stride Index (MSI) table is designed for pre-processing before going into the NFA. As the MSI table can filter most of unsuccessful matchings and thus significantly reduce the chance of processing on the NFA, the proposed MSI-NFA approach achieves a fast speed approximate to the DFA when processing real-world HTTP packets. As demonstrated in the experimental results, its speed is at most 10% lower than that of DFA. Moreover, the additional memory cost is as low as 20 KB compared with NFA.