1. Speculative Parallel Pattern Matching
Author:
Daniel Luchaup, Randy Smith, Cristian Estan, Somesh Jha
Publisher:
IEEE Transactions on Information Forensics and Security Presenter:
Zi-Yang Ou
Date:
2012/04/11

2. Introduction
Matching network traffic against a DFA is inherently a serial activity.
We break this inherent serialization imposed by the pointer chasing nature of DFA matching using speculation.
Our method works by dividing the input into multiple chunks and scanning each of them in parallel using traditional DFA matching.
The main idea behind our algorithm is to guess the initial state for all but the first chunk, and then to make sure that this guess does not lead to incorrect results.

3. Background

4. Signature Types Suffix-closed regular expressions
Prefix-closed regular expressions (PREs)
Ex: .*VIRUS.*
Anchored regular expressions (Non-PRE)
Ex: VIRUS
General regular expressions (GREs)
unrestricted, arbitrary regular expressions

5. Example of Using Speculation
coupling
validation region : IRUL

6. Statistical Support for Speculative Matching
The typical maximum TCP packet length is 1500 bytes.
We contend that the length of
the validation region will be
small.

7. Basic SPPM Algorithm

8. SPPM for Single-Threaded Software

9. SPPM for Parallel Hardware

10. SPPM for Parallel Hardware

11. Anchored Regular Expressions

12. General Case: Matching GREs

13. Bounding the Validation Region

14. Experimental Setup

15. Evaluation of Algorithm 3 (Single Threaded, Software Implementation)

16. Evaluation of Algorithm 4 (Basic SPPM for Prefix Closed Regular Expressions) Using Simulation

17. Validation Region

18. Evaluation of Algorithm 6 (SPPM for GREs) Using Simulation

19. Evaluation of Algorithm 7 (SPPM for PRE, With Bounded Validation Region) Using Simulation