Pattern overlap in bit-parallel implementation of regular expression repetition quantifiers
by Brendan Cronin; Xiaojun Wang
International Journal of Security and Networks (IJSN), Vol. 8, No. 4, 2013

Abstract: Deep Packet Inspection (DPI) in Network Intrusion Detection and Prevention Systems (NIDPS) typically involves the matching of packet payloads against attack signatures in the form of regular expressions (regexes). Existing research into the handling of the constrained {min, max} repetition syntax used in many regexes mainly proposes the use of a counting mechanism which avoids inefficient unrolling of the repeated sub-expression. However, many regexes cannot be handled as their format makes them susceptible to the problem of counter overlap. In this paper, we present a memory-centric bit-parallel hardware architecture that overcomes the issue of counter overlap through the use of a bit serial First-In-First-Out (FIFO) queue. The memory-centric rather than logic-centric nature of the design has the advantage of allowing dynamic updates to individual attack signatures. The solution proposed in this paper is targeted at ASIC and FPGA platforms and we present experimental results for a proof-of-concept design.

Online publication date: Sun, 08-Dec-2013

The full text of this article is only available to individual subscribers or to users at subscribing institutions.

 
Existing subscribers:
Go to Inderscience Online Journals to access the Full Text of this article.

Pay per view:
If you are not a subscriber and you just want to read the full contents of this article, buy online access here.

Complimentary Subscribers, Editors or Members of the Editorial Board of the International Journal of Security and Networks (IJSN):
Login with your Inderscience username and password:

    Username:        Password:         

Forgotten your password?


Want to subscribe?
A subscription gives you complete access to all articles in the current issue, as well as to all articles in the previous three years (where applicable). See our Orders page to subscribe.

If you still need assistance, please email subs@inderscience.com