Abstract:To solve the performance problem in Regular Expression matching of Protocol Identification, this paper introduces a Multi-pattern FSM (MPFSM), which can use one FSM to match several Regular Expressions. Based on Thompson algorithm, an Epsilon Compressed NFA Construction Algorithm is also put forward and implemented. This algorithm enhances the performance of conversion from NFA to DFA by decreasing the epsilon edges and the corresponding states. A One-pass Multiple-pattern protocol identification system is also implemented using the Multi-pattern FSM and corresponding algorithms. Experiments based on actual traffic are employed to show that the compile speed would be 7 times faster than the usual transfer process, and the Matching speed would be 20 times faster than the L7-Filter.