一种用于深度报文检测的DFA状态表压缩方法

Method to compress DFA transition table for deep packet inspection

基于正则表达式进行深度报文检测在IDS/IPS、应用层协议识别等网络应用中具有重要作用。然而,采用DFA实现正则表达式需要大量的存储空间,限制了它的实际应用。将DFA状态转换表拆分成3个表,使用run-length编码进行压缩,并对压缩方法进行了优化。采用l7-filter中几个常用应用程序的正则表达式进行测试,结果表明该方法压缩效果一般在90%以上。

Deep packet inspection based on regular expressions has become extremely important due to its applications in IDS/ IPS,application protocol recognition,etc.However, DFA transition table of regular expressions require large amounts of memory,and this limits its practical application.This paper splits the DFA transition table into three tables,compresses the tables using runlength coding,and some optimizations are introduced.The test result using some normal applications in 17-filter indicates that the method has more than 90% compressing rate.