A study of the memory-based NFA regular expression match engine for signature-based intrusion detection

Abstract

In this final year project, a supporting programming is developed for the memory-based non-deterministic finite automaton (NFA) regular expression match engine for signature-based intrusion detection, which aims to generate the control bits and replace the control bits quickly for the match engine system which processes multiple symbols per cycle. And some modification of the system is made to achieve processing multiple bits per cycle. The match engine system is to inspect network traffic at wire-speed for the signature-based intrusion detection. In this specially designed NFA match engine, each MX-NFA (memory-based NFA) match unit contains several control logic circuit which are instructed by the pre-defined control bits. The control bits of the match unit are required to be updated and added frequently, which is a heavy work if the control bits are set manually. The program in the final year project helps to generate control bits for the match engine with two characters processing at one time according to the given regular expression (regex) pattern.