Optimization of Regular Expression Processing Circuits for NIDS on FPGA

Recent Network Intrusion Detection System (NIDS) utilizes more and more Regular Expression to describe malicious patterns existing in the content payload of packets. Many researches are investigated and several techniques are introduced to optimize performance and support all functions of regular expression on hardware platform. However there is very few researches in the minimization of multiple regular expressions. This paper takes in account of compiling multiple regular expressions with respect to optimize hardware resources. We take advantage of block memory to implement character matching and present a novel sharing architecture which completely supports sharing common parts among given set of regular expressions. Experimental results show that our optimization can reduce 46% area circuits compared with previous approaches and achieve throughput of 1.5-2.1 Gbps on Snort malicious database.