Optimization of Regular Expression Pattern Matching Circuits on FPGA Authors: Cheng-Hung Lin, Chih-Tsun Huang, Chang-Ping Jiang, and Shih-Chieh Chang Publisher: IEEE VLSI, 2007 Present: Pei-Hua Huang Date: 2014/02/19

Introduction Regular expressions are widely used in the network intrusion detection system (NIDS) to represent attack patterns Due to the rapid increase of network attacks and data traffic, traditional software-only NIDS may be too slow for networking needs many studies [1][2][3][4][5] proposed hardware architectures for accelerating attack detection the main challenges of hardware implementation is to accommodate the large number regular expressions to FPGAs 1

Introduction 2

3

Regular expressions for attacks’ description In Snort, two types of regular expression are used to describe attack patterns The first type defines exact string patterns such as "Ahhhh My Mouth Is Open.” The second type consists of meta-characters (^, $, |, *, ?) ex. “^GET[^s]{432}” 4

Minimization of regular expression circuits Given m regular expressions, R 1,R 2,…, R m, and assuming that all of them have the infix common sub-pattern, R c, the m regular expressions can be represented as R 1pre R c R 1post, R 2pre R c R 2post,…, and R mpre R c R mpost two additional circuit blocks are inserted The switch module is used to memorize where the trigger signal comes from DeMux (De-Multiplexer) to guide the output of R c to the correct postfix circuit 5

Minimization of regular expression circuits 6

The new architecture has two constraints Constraint 1: For the m regular expressions in Figure 4, {R 1pre R c R 1post, R 2pre R c R 2post, …, R mpre R c R mpost }, the prefix R jpre cannot be null for j ∈ 1...m 7 Pattern1: abcdefgh Pattern2: defpq

Constraint 2: For the m regular expressions in Figure 4, {R 1pre R c R 1post, R 2pre R c R 2post, …, R mpre R c R mpost }, the R c cannot be shared if R jpre ⊂ R kpre R c, ∀ k ≠ j, k, j ∈ 1…m 8 Pattern1: abcdefgh Pattern2: dedefpq

Regular expression module generator The sharing gain of a common sub-pattern is defined to be the number of characters in the sub-pattern multiplies by the number of regular expressions having the sub-pattern For example, three regular expressions, “1Common1”, “2Common2”, and “3Common3” have the common sub- pattern “Common.” The sharing gain of the common sub- pattern is 18=6*3 9

10

Basic components of NFA approach 11

Basic components of NFA approach 12

Experimental results the regular expression patterns from Snort and Trend Micro all circuits being synthesized by Xilinx ISE7.1i, where the target FPGA is Xilinx Virtex XCV2000E consisting of 19,200 slices 13

14