1. 1 Optimization of Regular Expression Pattern Matching Circuits on FPGA Department of Computer Science and Information Engineering National Cheng Kung University, Taiwan R.O.C. Authors: Cheng-Hung Lin, Chih-Tsun Huang, Chang-Ping Jiang, and Shih-Chieh Chang Publisher: IEEE TRANSACTIONS ON VERY LARGE SCALE INTEGRATION (VLSI) SYSTEMS, VOL. 15, NO. 12, DECEMBER 2007 Present: Chen-Rong Chang Date: November, 12, 2008

2. 2 Outline Introduction Implementation of NFA Regular expressions Sharing prefix common sub-patterns Sharing scheme for infix and suffix Flow of RE module generation The comparison

3. 3 Introduction 3 Regular expressions are widely used in the network intrusion detection system (NIDS) to represent attack patterns. In contrast to software-only NIDS, many studies proposed hardware architectures for accelerating attack detection Sidhu and Prasanna [1] proposed to construct an NFA (Nondeterministic Finite Automaton) from a regular expression to perform string matching. Hutchings, Clark et al. [3] made excellent area and throughput by adding predecoded wide parallel inputs to traditional NFA implementations.

4. Predecoder Scheme 4

5. 5 Simple NFA and implementation in logic

6. 6 Regular expressions for attacks’ description Regular expressions are a common way to express attack patterns. In Snort, two type of regular expression are used to describe attack pattern 1. The first type defines exact string patterns such as pattern, "Ahhhh My Mouth Is Open.” 2. The second type consists of meta- characters( *,|,$,... )

7. Regular expressions for attacks’ description (cont.) Given a regular expression A partial expression,is a prefix of P if k<m. A partial expression,is an infix of P if j>1 and k<m And a partial expression is a suffix of P if j>1. Ex: expression => “networking.” The partial expression “net” is a prefix, “work” is an infix, and “ing” is a suffix 7

8. 8 Sharing prefix common sub- patterns

9. 9 An erroneous implementation to share infix Dir Input String => “PassSysDirUserGate” It may be mistaken as a match at the output of the upper blocks Called “False positive”

10. Sharing common Suffix 10

11. 11 Sharing scheme for infix and suffix

12. 12 Two patterns share common infix R C Form: R1RcR1 R2RcR2

13. 13 Example of critical section problem Pattern1: abcdefgh Pattern2: dedefpq

14. Cross-Subexpression Definition: An expression,is called the cross-subexpression of if is not a subexpression of and is a subexpression of EX: R1=“abc”, R2=“def” cross-subexpression: “cde”,”cdef”,”bcd”,”bcde”,”bcdef” 14

15. Necessary Condition Theorem: If has the critical section problem, either is a cross-subexpression of, or I is a cross-subexpression of EX: R 1 = abc R 2 = cde R C = defgh As long as R 1 or R 2 is a cross-subexpression, the critical section problem will happen. 15

16. 16 Sharing gain The sharing gain of a common sub-pattern is defined to be the number of characters in the sub- pattern multiplies by the number of regular expressions having the sub-pattern. For example, three regular expressions, “1Common1”, “2Common2”, and “3Common3” have the common sub-pattern “Common.” The sharing gain of the common sub-pattern is 6*3=18

17. 17 Flow of regular expression module generation

18. 18 Logical structures for the proposed meta-character components

19. Logical structures for the proposed meta-character components (cont.) 19

20. 20 Logical structures for the proposed meta-character components (cont.)

21. 21 Implementation of NFA

22. 22 The comparison among different approaches on Snort rule sets