基于多级存储器的正则表达式匹配技术研究

Regular Expression Matching is one of the criticial components in network security inspection, which is an important mean of network security defense and computer crime forensics. As the emergencies of various network applications and attacks, patterns used to describe the features of applications and attacks need to be extendible, while as the frequent upgrading of links' bandwith, the traffic needs to be scanned linearly is increasing likewise. As a result, the issues of performance and extendiability of regular expression matching have become increasingly prominent. This project try to research on the natural laws which lead to the inflation of state transition table when multiple regular expressions are being compiled, the features of coupling and distribution when patterns are added to the state transition table of multi-pattern automata, and the convergence in matching. The different features in performance, bandwith, latency and concurrent matching of TCAM, SRAM, DRAM and internel memory of FPGA will also be researched into. We will try to break through the critical techniques on multi-level storage architure, matching engine with low cost of memory, volatile multi-byte matching, and concurrent matching on core states. All of these techniques will be of benefit to the matching performance. To evaluate the abovementional theories and techniques, a high-speed inspection system will be designed, implemented and applied to the actual network environments. The main purpose of this project is to provide technicial support for network security inspection of the network backbone links.

正则表达式（Regex）匹配是网络安全检测的关键部件之一，是网络安全防护和计算机犯罪取证的重要手段。随着网络应用和攻击的不断出现，用于描述应用特征和攻击特征的模式需要不断扩展；而随着链路带宽的不断升级，必须线速扫描的流量也同步增加。这使得Regex匹配面临的高性能和特征可扩展问题日益突出。本项目拟研究Regex特征码编译过程中状态急剧膨胀的内在规律，多模式复合自动机的状态转移表在特征增加过程中的耦合和分布特性，以及在匹配过程中的收敛性，并探索 FPGA片内存储器、TCAM、SRAM以及DRAM等存储器件在性能、带宽、延迟、并行匹配等方面的不同特性，突破使用复合多级存储器结构实现高速、低存储代价的匹配引擎，并通过可变多字节检测、核心状态并行匹配等关键技术加速匹配过程，并通过设计和实现可应用于实际网络环境的高速检测系统对理论和方法进行评估，为骨干链路安全检测提供基础技术支撑。

正则表达式（Regex）匹配是网络安全检测的关键部件之一，是网络安全防护、内容审计和计算机犯罪取证的基石。随着移动网络的广泛应用和移动APP的不断出现，用于描述应用特征和攻击特征的模式需要不断扩展；而随着链路带宽的不断升级，必须线速扫描的流量也同步增加。这使得Regex匹配面临的高性能和特征可扩展问题日益突出。本项目研究了正则表达式特征码编译过程中状态急剧膨胀的内在规律，多模式复合自动机的状态转移表在特征增加过程中的耦合和分布特性，以及在匹配过程中的收敛性，并探索FPGA片内存储器、TCAM、SRAM以及DRAM等存储器件在性能、带宽、延迟、并行匹配等方面的不同特性，突破了正则表达式编译速度，以及使用复合多级存储器结构实现高速、低存储代价的匹配引擎，并通过可变多字节检测、核心状态并行匹配、大规模流表查询等关键技术加速匹配过程，设计和实现可应用于实际网络环境的高速检测系统对理论和方法进行评估，为骨干链路安全检测提供基础技术支撑。