LaFA Lookahead Finite Automata Scalable Regular Expression Detection Authors : Masanori Bando, N. Sertac Artan, H. Jonathan Chao Masanori Bando N. Sertac Artan H. Jonathan Chao Publisher : ANCS '09 ANCS '09 Presenter : 楊皓中 Date : 2014/06/17 Department of Computer Science and Information Engineering National Cheng Kung University, Taiwan R.O.C.

Introduction We propose Lookahead Finite Automata (LaFA) to perform scalable RegEx detection using very small amount of memory. LaFA's memory requirement is very small due to the following three areas of effort described in this paper: (1) Different parts of a RegEx, namely RegEx components, are detected using different detectors, each of which is specialized and optimized for the detection of a certain RegEx component. (2) We systematically reorder the RegEx component detection sequence, which provides us with new possibilities for memory optimization. (3) Many redundant states in classical finite automata are identified and eliminated in LaFA. National Cheng Kung University CSIE Computer & Internet Architecture Lab 2

A Warm-up example National Cheng Kung University CSIE Computer & Internet Architecture Lab 3

Separation of Simple String Matching A simple string is a fixed sequence of characters such as “abc" and “op" in r1. The resulting FA, as shown in Figure 1 (c), has fewer states than NFA. By generating one detection event per simple string, rather than making many state transitions for each input character as in an NFA or DFA, National Cheng Kung University CSIE Computer & Internet Architecture Lab 4

Reordering The Detection Sequence Consider matching the example input string “abcxop“ We observe that the FAs for r2 and r3 made the unnecessary [a-z] detection just to abandon the search at the end when neither “qr" or “st“ is found in the input. National Cheng Kung University CSIE Computer & Internet Architecture Lab 5

Reordering The Detection Sequence In general,we can classify components in RegExes based on the information revealed about a RegEx. we call components that reveal more information like abc deep components that do not reveal much information like [a-z] shallow components. National Cheng Kung University CSIE Computer & Internet Architecture Lab 6

Reordering The Detection Sequence There are deep components that are more complex to detect than simple strings. For example, a string repetition element \n{x,y} is deep but requires more complex operations than an exact string matching LaFA detects simple and deep components ahead of complex and/or shallow ones. National Cheng Kung University CSIE Computer & Internet Architecture Lab 7

Variable String Detection and Sharing detection of some components (in our example, the [a-z] component) only needs to be done once at any given time. Instead of duplicating those components in multiple RegExes, we can save resources and memory by sharing those rarely used components. National Cheng Kung University CSIE Computer & Internet Architecture Lab 8

Summary 1. RegExes are first represented in NFA format. 2. the states of simple strings are identified and merged into super states. 3. The components are reordered according to their depth and complexity. 4. Finally, the states of components that can potentially be shared among RegExes are merged. National Cheng Kung University CSIE Computer & Internet Architecture Lab 9

LAFA DATA STRUCTURE AND ARCHITECTURE Each detection event consists of a unique ID for the detected component, and its location in the input packet. string event in-line event National Cheng Kung University CSIE Computer & Internet Architecture Lab 10

the LaFA Data Structure the LaFA data structure is constructed in three steps: (1) RegEx partitioning partition each RegEx into simple strings(S) and variable strings(V). (2) Component reordering (3) Node structure construction. National Cheng Kung University CSIE Computer & Internet Architecture Lab 11

the LaFA Data Structure Node structure construction. A simple string each node has the following: 1. A pointer to the next state 2. the status of the current state 3,4. minimum and maximum time values. The variable strings 1. module ID (define which special module is used to detect) 2. pattern ID (for example [a-z] and [0-9] are assigned different IDs) 3,4. minimum and maximum repetition value for those components that have repetition notations 5,6 minimum and maximum timing values. National Cheng Kung University CSIE Computer & Internet Architecture Lab 12

Correlation Block National Cheng Kung University CSIE Computer & Internet Architecture Lab 13

Correlation Block It is important to note that LaFA avoids this drawback by duplicating the detection block and correlation block, and performing the detection operation in parallel. We call this block, consisting of one set of detection and correlation blocks, a track. For instance, we deploy two tracks in the example case, so detection operations of r1 and r4 are performed in separate tracks. As a result, LaFA can keep one operation (in parallel) per detection events. National Cheng Kung University CSIE Computer & Internet Architecture Lab 14

Detection Block buffered lookup modules Timestamps Lookup Module (TLM)  VA,VB,VC Character Lookup Module (CLM)  VH in-line lookup modules. Repetition Detection Module (RDM)  VD,VE,VF,VG National Cheng Kung University CSIE Computer & Internet Architecture Lab 15

Timestamps Lookup Module (TLM) National Cheng Kung University CSIE Computer & Internet Architecture Lab 16

Character Lookup Module (CLM) National Cheng Kung University CSIE Computer & Internet Architecture Lab 17

Repetition Detection Module (RDM) RDM detects components in the form base { x,y } by accepting consecutive repetitions of the base, x to y times in the input Let a RegEx r detection be in progress that expects a repetition next. This expected repetition is programmed into an available RDM sub-module, PatternID, with the minimum and maximum repetition values. The sub-module inspects the input packet for the expected base and counts consecutive repetitions of this base. When the input satisfies a repetition programmed on a RDM sub-module, RDM generates an in-line event, which causes the activation of the next node. National Cheng Kung University CSIE Computer & Internet Architecture Lab 18

Repetition Detection Module (RDM) For fixed-range repetition (e.g., [a-z]{5,10}), after the minimum consecutive detections (e.g., 5), the next simple-string node is activated. However, when the consecutive count reaches the maximum count (e.g., 10), the next simple-string node is deactivated and the RDM resources are released for use by other RegEx components. National Cheng Kung University CSIE Computer & Internet Architecture Lab 19

PERFORMANCE National Cheng Kung University CSIE Computer & Internet Architecture Lab 20

PERFORMANCE National Cheng Kung University CSIE Computer & Internet Architecture Lab 21

PERFORMANCE National Cheng Kung University CSIE Computer & Internet Architecture Lab 22