Title: Pattern overlap in bit-parallel implementation of regular expression repetition quantifiers

Authors: Brendan Cronin; Xiaojun Wang

Addresses: The Rince Institute, School of Electronic Engineering, Dublin City University, Dublin 9, Ireland ' The Rince Institute, School of Electronic Engineering, Dublin City University, Dublin 9, Ireland

Abstract: Deep Packet Inspection (DPI) in Network Intrusion Detection and Prevention Systems (NIDPS) typically involves the matching of packet payloads against attack signatures in the form of regular expressions (regexes). Existing research into the handling of the constrained {min, max} repetition syntax used in many regexes mainly proposes the use of a counting mechanism which avoids inefficient unrolling of the repeated sub-expression. However, many regexes cannot be handled as their format makes them susceptible to the problem of counter overlap. In this paper, we present a memory-centric bit-parallel hardware architecture that overcomes the issue of counter overlap through the use of a bit serial First-In-First-Out (FIFO) queue. The memory-centric rather than logic-centric nature of the design has the advantage of allowing dynamic updates to individual attack signatures. The solution proposed in this paper is targeted at ASIC and FPGA platforms and we present experimental results for a proof-of-concept design.

Keywords: intrusion detection; DPI; deep packet inspection; regular expression; repetition constraint; NFA; non-deterministic finite automaton; NIDPS; bit-parallel hardware; pattern overlap; network security; packet payloads; attack signatures; memory-centric.

DOI: 10.1504/IJSN.2013.058154

International Journal of Security and Networks, 2013 Vol.8 No.4, pp.231 - 238

Published online: 08 Dec 2013 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article