Selective Regular Expression Matching Author: Natalia Stakhanova, Hanli Ren, Ali A.Ghorbani Publisher: Information Security Conference 2010 Presenter: Zi-Yang Ou Date: 2012/04/25

Introduction Instead of serially matching all regular expressions, we compile a set of shortest patterns most frequently seen in regular expressions that allows to quickly filter out events that do not match any of the IDS signatures.

Introduction

Deriving Regex Patterns

Ensuring Matching Correctness

Optimizing Regex Tree -Rule Reduction

Optimizing Regex Tree -Pattern Reduction

Optimizing Regex Tree -Pattern Selection The pattern selection aims to select an optimal set of root nodes. We seek to minimize set of patterns such that every re RE is covered by at least one . Minimum set cover problem. The algorithm selects a subset ( ) that covers the most of uncovered regular expressions.

Selective Matching Algorithm

Evaluation Results

Evaluation Results

Evaluation Results