用优化的正则表达式引擎进行快速网络流分类  

Optimized Regular Expression Matching Engine for Fast Network Traffic Classification

作　　者：王建敏[1] 曾凡平[1,2,3] 王健康[1] 

机构地区：[1]中国科学技术大学计算机科学与技术学院,合肥230026 [2]中国科学院软件研究所计算机科学国家重点实验室,北京100190 [3]安徽省计算与通讯软件重点实验室,合肥230026

出　　处：《小型微型计算机系统》2015年第12期2690-2695,共6页Journal of Chinese Computer Systems

基　　金：安徽省自然科学基金项目(11040606M131)资助

摘　　要：依赖于正则表达式匹配的深度包检测技术因准确率高成为网络流分类广泛使用的技术.为了能在线性时间内对网络流进行快速分类,需采用时间高效的确定性有限自动机（DFA）匹配引擎,但DFA存在空间爆炸问题,无法满足实际需求.为了解决这个问题,本文从DFA中每个状态在不同的输入字符转换下到达的目的状态特性出发,提出了一种基于默认目的状态和位图技术的DFA压缩算法（对应的自动机模型称为DBDFA）,该算法能够将有着相同目的状态的多条转移边压缩为只需一个默认目的状态或只需一个时空高效的位图.实验表明,DBDFA能达到平均99%的压缩效率,优于目前大多数的DFA压缩技术,且压缩后的总体匹配效率是原有DFA的3~5倍,这是目前大部分的压缩技术所不能达到的.Deep Packet Inspection which relies on regular expression matching has become widely used network traffic classification technology due to its high accuracy. Time-efficient Deterministic Finite Automata （ DFA ） is usually preferred for fast traffic classifica- tion at line rate. However, DFA cannot meet the actual needs because of space explosion problem. In order to address this, by analyzing the destination state characteristics from different transitions, this paper proposes a DFA compression algorithm based on Default desti- nation state and Bitmap technology, called DBDFA, which can compress multiple different transitions that has the same destination state into just a default destination state or a space-efficient bitmap. Experimental results show that DBDFA achieves space savings of 99% over the original DFA,better than most state-of-the-art DFA compression techniques. More importantly, DBDFA＇s matching effi- ciency is three to five times the original DFA, which is generally other compression techniques can not achieve.

关 键 词：流量分类 正则表达式 特征匹配 默认目的状态 位图 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]