To solve the performance problem in Regular Expression matching of Protocol Identification, this paper introduces a Multi-pattern FSM (MPFSM), which can use one FSM to match several Regular Expressions. Based on Thompson algorithm, an Epsilon Compressed NFA Construction Algorithm is also put forward and implemented. This algorithm enhances the performance of conversion from NFA to DFA by decreasing the epsilon edges and the corresponding states. A One-pass Multiple-pattern protocol identification system is also implemented using the Multi-pattern FSM and corresponding algorithms. Experiments based on actual traffic are employed to show that the compile speed would be 7 times faster than the usual transfer process, and the Matching speed would be 20 times faster than the L7-Filter.
参考文献
相似文献
引证文献
引用本文
陈曙晖,苏金树.基于内容分析的协议识别研究[J].国防科技大学学报,2008,30(4):82-87. CHEN Shuhui, SU Jinshu. Protocol Identification Research Based on Content Analysis[J]. Journal of National University of Defense Technology,2008,30(4):82-87.