Offset-FA: Detach the Closures and Countings for Efficient Regular Expression Matching

Abstract

Fast regular expression matching (REM) is the core issue in deep packet inspection (DPI). Traditional REM mainly relies on deterministic finite automaton (DFA) to achieve fast matching. However, state explosion usually makes the DFA infeasible in practice. We propose the offset-FA to solve the state explosion problem in REM. The state explosion is mainly caused by the features of the large character set with closures or counting repetitions. We extract these features from original patterns, and represent them as an offset relation table and a reset table to keep semantic equivalence, and the rest fragments are compiled to a DFA called fragment-DFA. The fragment-DFA along with the offset relation table and reset table compose our Offset-FA. Experiments show that the offset-FA supports large rule sets and outperforms state-of-the-art solutions in space cost and matching speed.