Efficient mapping of nondeterministic automata to FPGA for fast regular expression matching

With the growing number of viruses and network attacks, Intrusion Detection Systems have to match a large set of regular expressions at multi-gigabit speed to detect malicious activities on the network. Many algorithms and architectures have been designed to accelerate pattern matching, but most of them can be used only for strings or a small set of regular expressions. We propose new NFA-Split architecture, which reduces the amount of consumed FPGA resources in order to match larger set of regular expressions at multi-gigabit speed. The proposed reduction uses model of nondeterministic and deterministic automaton for effective mapping of regular expressions to FPGA. A new algorithm is designed to split the nondeterministic automaton transition table in order to map a part of the table into memory. The algorithm can place more than 49% of transition table to memory, which reduces the amount of look-up tables by more than 43% and flip-flops by more than 38% for all selected sets of regular expressions. Moreover, a sparse transition table is mapped to memory with overlapped rows, which enables to store the table in a highly compact form.