S.: Two-phase Pattern Matching for Regular Expressions in Intrusion Detection Systems. Journal of information science and engineering 26

Regular expressions are used to describe security threats ’ signatures in network in-trusion detection (NID) systems. To identify suspicious packets using regular expression matching, many NID systems use memory-based deterministic finite-state automata (DFA) with one-pass-scanning model, which is fast and allows dynamic updates. How-ever, a number of practical signature patterns commonly found in a variety of NID sys-tems, e.g., “.*A.{N}B”, can cause a state-explosion problem in such a model. In this paper, we propose a two-phase pattern matching engine (TPME) to solve this problem. In our proposed approach, the state storage cost is reduced to linearly dependent on the number of repetitions N in the patterns. With the new approach, we are now able to han-dle those practical patterns that would have caused the state-explosion problem in mem-ory-based DFA. We report our implementation of TPME on a field programmable gate array (FPGA). With our prototype implementation, we can achieve a throughput of more than 1.86 gigabits per second for pattern matching in a practical NID system