TCAM-based DFA deflation: A novel approach to fast and scalable regular expression matching

The paper discusses the implementation of deterministic finite automaton (DFA) using ternary content addressable memory (TCAM) for regular expression matching. Regular expression matching is the foundation of many network functions including intrusion detection, worm detection, traffic analysis and so on, where known patterns such as worm fingerprints are characterized using regular expressions and searched in network traffic for pattern match. As the quantity and diversity of known patterns keep increasing, regular expression pattern sets have rapidly grown in both size and complexity, while having to be matched in network traffic at accelerating wire speeds. Fast and scalable regular expression matching, therefore, is fundamental to the development of practical network systems.Regular expression matching is carried out using either nondeterministic finite automaton (NFA) or deterministic finite automaton (DFA). The paper states that no existing method has been able to deflate exponentially growing DFA state space, without paying penalty on matching efficiency. Fast and scalable regular expression matching, where it takes merely a small constant number of memory accesses to match each input character and storage space growing linearly with pattern set size, remains an open problem calling for innovative research.