HIGH-SPEED REGULAR EXPRESSION MATCHING ENGINE USING MULTI-CHARACTER NFA

Size: px

Start display at page:

Download "HIGH-SPEED REGULAR EXPRESSION MATCHING ENGINE USING MULTI-CHARACTER NFA"

Bethany Wood
5 years ago
Views:

1 HIGH-SPEED REGULAR EPRESSION MATCHING ENGINE USING MULTI-CHARACTER NFA Noro Ymgk, Rtnr Shu, Stosh Kmy Systm IP Cor Rsrh Lortors NEC Corporton Kwsk, Kngw, Jpn ml: ABSTRACT An pproh s prsnt or hgh throughput mthng o rgulr xprssons (rgxs) y rst onvrtng thm nto orrsponng Non-trmnst Fnt Automt (NFAs) whh r thn ongur onto FPGA. Th ky novl tur s thnqu tht, or ny gvn rgx, onstruts n NFA tht prosss multpl hrtrs pr lok yl. An nt lgorthm s propos tht outputs n NFA whh prosss tw th numr o hrtrs s th nput on. A thnqu s lso propos tht mplmnts th rng mth oprton (.g. [-z]) ntly. A progrm hs n wrttn tht mplmnts ov s to onvrt rgxs nto NFAs sp n struturl Hrwr Dsgn Lngug (HDL), whh r thn mpp onto FPGA. Prormn s vlut usng rl worl rgxs (Snort rulst). Th rsults monstrt th prtl utlty o th pproh. For xmpl, or st o 2,69 rgxs, whl th stnr - hrtr NFA otns throughput o.25 Gps, our 4- hrtr NFA hvs throughput o 3.63 Gps, whl rqurng only 20% mor LUTs n 6% lss lp-lops.. INTRODUCTION Ntwork nwths hv n rsng rply. At th sm tm, th rquny o ntwork ttks n spm hs n nrsng. It s lso omng mor mportnt to prov vryng Qulty o Srv (QoS) to rnt typs o tr. All ov prolms rqur pkt prossng, ky oprton o whh s srhng pkt ontnts or sp pttrns whh r typlly sp s rgulr xprssons (hnorth ll rgx ). Howvr, ong so t throughput tht mths ntwork nwth, whl rul, hs provn qut hllngng. Typlly, on mroprossors, rgx mthng [] s prorm y rst onvrtng th gvn rgx nto orrsponng NFA or Dtrmnst Fnt Automton (DFA) whh s thn us to srh nput txt hrtrs. Whl DFA n pross h hrtr n onstnt tm (.. t rqurs O() tm), th numr o DFA stts, or n * Ths work ws prtly support y Mnstry o Intrnl Ars n Communtons (MIC) n Jpn. * Th uthors knowlg th sgnnt work ssstn o Ashwn H. S. n mplmntton o th propos pproh. Appl Rsrh Group Stym Computr Srvs Lt. Bnglor, In ml: Rtnr_Shu@stym.om n hrtr rgx, n O(2 n ) [2], whh n som ss n sgnntly gr prormn. On FPGAs, on th othr hn, rgx mthng n prorm usng NFAs, gn tkng onstnt tm pr txt hrtr. An sn NFA sz s only O(n) [2], th ov prolm s vo. Whl NFAs n us on mroprossors s wll, ong so woul rqur O(n) tm pr nput txt hrtr. On FPGAs, ov tm s ru O() y xplotng th vll n-grn prlllsm whh monstrts unmntl vntg FPGAs hv ovr mroprossors or rgx mthng (or mor tls, pls s R. [3]). Whl FPGAs hv n us or smpl strng mthng [4], th ous o ths ppr s on rgx mthng. Whl th ov NFA-s pproh s qut nt n throughput otn s hgh, t s not hgh nough n th ontxt o mult-ggt wr sps xstng toy n vn str sps xpt n th nr utur. So to mprov throughput o ov pproh, som works [5][6] hv n on on onstrutng NFAs tht pross multpl hrtrs pr lok yl (hnorth ll multhrtr NFA ). Whl mprov throughput s shown or som xmpls, no prour s prov or onvrtng n rtrry rgx nto mult-hrtr NFA. Ths ppr lso proposs n pproh or onvrtng rgx nto mult-hrtr NFA, ut th pproh s rnt rom ov prvous works. Algorthms r prov to onvrt n rtrry rgx nto n NFA pl o prossng 2 k hrtrs (or sr nturl numr k) pr lok yl. Prhps s mportntly, n omprson to prvous works, th mount o tonl log rqur or mult-hrtr NFA (rltv to -hrtr NFA) s qut most. In ton, thnqu to gnrt nt rng mth log s lso prsnt. Th ov s r mplmnt n progrm tht outputs NFAs sp n struturl HDL whh n mpp onto n FPGA. Th sgnnt throughput mprovmnt otn usng th propos pproh, usng only rltvly smll mount o tonl log s monstrt y th rsults otn or w thousn rl worl rgxs xtrt rom Snort rulst [7]. Th rst o ths ppr s orgnz s ollows: Ston 2 prsnts th kgroun. Th propos pproh s sr n Ston 3, n th prormn vluton n Ston 4. Fnlly, Ston 5 onlus ths work /08/$ IEEE. 3 Authorz lns us lmt to: IEEE plor. Downlo on Mrh 4, 2009 t 03:6 rom IEEE plor. Rstrtons pply.

2 2. BACKGROUND Frst, w ous on th NFA-s rgx mthng log on FPGAs. Nxt, w suss rlt works usng multhrtr NFA so r. 2.. NFA-s Rgx Mthng Log Shu, t l. propos nw rgx mthng log sgn mthoology [3]. Thy mplmnt h stt o NFA s lp-lop, n ts vlu shows whthr th stt s tv or not. Thy lso propos thr s NFA log struturs or th mthrtrs o rgxs,, n *, n on log strutur or othr hrtrs. In th syntx tr, th nonl mthrtr nos n th l hrtr nos r rpl y th orrsponng log struturs ylng th rqur NFA log. Fgur shows n xmpl o NFAs rgx mthng log or ()*( ), whr th oxs to r hrtr omprtors. Th smpl n nt NFA log sgn nls hgh throughput. Sn log ns to rongur whn rgxs r mo, th us o rongurl v lk FPGA s rqur NFA-s Rgx Mthng Log usng Mult- Chrtr NFA In th ov rhttur, sngl txt hrtr s pross n h lok yl. On th othr hn, to mprov throughput, som works hv n unrtkn tht pross multpl hrtrs pr lok yl. Clrk, t l. [5] propos nw rhttur usng multhrtr NFAs, whos trnston ontons (lls) onsst o multpl hrtrs. In ths rgr, howvr, to tkl whrvr th hrtr strng o th ll strts n th nput strng, th sm numr o NFAs s prossng hrtrs r rqur or rgx onsrng th ost. Thror, lthough t n mprov th throughput, ts lty to o so s lmt y th somwht sgnnt nrs n log sz. Sutton [6] lso proposs nw rhttur usng th smlr mnnr to Clrk, t l., th rn ng prlll or squntl prossng o multpl hrtrs. Ths pproh mplmnts multpl hrtr omprtors twn lp-lops. Howvr, mor th hrtrs pross pr lok yl, th longr h pth twn lp-lops oms. As rsult, oprtng rquny woul rs, rung th gn n throughput. Morovr, non o th ov gvs n tv prour to onstrut multhrtr NFA or n rtrry rgx. 3. PROPOSED METHOD W propos novl log sgn mtho usng multhrtr NFAs to rlz hgh-sp rgx mthng. Th mtho pts svrl rgxs s nput, n outputs srpton o th orrsponng NFAs n HDL. Tht s, t s xut s prlmnry stp or th hrwr ongurton. Ths mtho onssts o two ky tsks; Mth Rsult Input Txt Chrtr Fg.. NFA-s rgx mthng log or ()*( ). NFA Construton: prsng o nput rgx nto th syntx tr, onvrson o th tr nto n NFA strutur, n moton o th NFA to support multpl hrtrs pr lok yl. HDL Gnrton: spton o th ov multhrtr NFA usng struturl HDL. By prormng th NFA onstruton tsk, our mtho n onvrt n nput rgx nto th NFA whh n pross multpl (powr o two) hrtrs pr lok yl. Unlk th rhttur prsnt n R. [5], our mtho onstruts sngl mult-hrtr NFA whh hs lmost th sm numr o stts s n orgnl -hrtr NFA. I only th mthng rgx n not th xt mth poston s rqur, th onstrut mult-hrtr NFA hs xtly th sm numr o stts s th orgnl NFA. In th HDL gnrton tsk, w lso propos thnqu to gnrt nt rng mth log. In ths wy, our mtho n ongur th rgx mthng log whh n pross multpl hrtrs pr lok yl, n t n xpt to mprov throughput. In th ollowng, w xpln th NFA onstruton tsk n th rng mth log sgn. 3.. NFA Construton NFA onstruton tsk onssts o two su-tsks whh r sr n th ollowng stons; Phs : Convrson o rgx n post-orr nto ts NFA grph tht prosss sngl hrtr vry lok yl. Phs 2: Convrson o th ov -hrtr NFA grph nto n NFA grph tht n pross 2 k hrtrs (or sr nturl numr k) hrtrs vry lok yl. In phs, n nput rgx n post-orr orm s us to rt th NFA grph orrsponng to th rgx. In orr to prorm ths tsk or th vrous mthrtrs, vrous grph oprtons hv n vlop. In phs 2, w propos smpl lgorthm s on th trnstv grph losur n xut numr o tms pnng on th numr o prossng hrtrs pr lok yl. Th rsultng grph rprsnts th NFA whh n pross th sr numr o hrtrs, 2 k, n prlll Phs : Rgulr Exprsson to -Chrtr NFA Th nput to th phs o NFA onstruton tsk s rgx n post-orr n th output s -hrtr NFA or th nput rgx. Th rgx n post-orr n sly otn 32 Authorz lns us lmt to: IEEE plor. Downlo on Mrh 4, 2009 t 03:6 rom IEEE plor. Rstrtons pply.

3 or = to lngth(str) 2 swth(str[]) 3 s : push(pro_or(pop(), pop())) 4 s : push(pro_n(pop(), pop())) 5 s - : push(pro_rng(pop(), pop())) 6 s? : push(pro_qus(pop())) 7 s + : push(pro_plus(pop())) 8 s * : push(pro_str(pop())) 9 ult : push(pro_hr(str[])) Fg. 2. Psuo o o phs (NFA onstruton). () () () * * * G 3 G 2 G G 5 G G 9 G 6 () () () * * * Fg. 4. An xmpl o th stk n phs. G 4 G G 8 G 7 G 6 G 0 sl g ll to ntl no 2 or h nl no, nw nl no n onnt ormr to lttr y g ll 3 4 or n = h no n grph 5 or = h no hvng g to no n 6 or j = h no hvng g rom no n 7 (g (n, j) sl g t ln ) 8 nw g (, j) 9 ont. lls o gs (, n), (n, j) 0 ov ll to nw g (, j) 2 rmov th orgnl nput grph gs, n th gs nsrt t lns n 2 G G 4 G 5 G 9 G 2 G 7 G 0 G 6 G 3 G 8 Fg. 3. Psuo o o phs 2 (NFA onstruton). Fg.5. Exmpls o NFA grphs n phs. y post-orr trvrsl o ts syntx tr. For xmpl, th rgx ()*( ), n post-orr orm s *. Fgur 2 shows th lgorthm. Although ths lgorthm s ssntlly th sm s n R. [3], t hs two tonl untons or mthrtrs? n +. In Fgur 2, str s th post-orr rgx n stk s us to stor ps o th NFA grph urng prossng. For xmpl, th pro_hr unton onstruts smpl NFA grph lk th grph G n Fgur 5. In th grph G, thr r thr nos n two gs, n g ll (whh nots n rtrry hrtr) rom th ntl no to th ntrmt on, n n g ll th hrtr str[] rom th ntrmt no to th nl on. Ths untons pt on or two NFA grphs, n thy ll output n NFA grph, whos ntl no hs only output gs ll n nl no hs only nput gs. Th s NFA grphs onstrut y th untons or th mthrtrs,, n * r s on R. [2]. Sn pro_str, pro_qus, n pro_plus tk O(n) tm n th othr untons tk O() tm, whr n s th lngth o th rgx, th lgorthm rqurs O(n 2 ) tm Phs 2: -hrtr to Mult-hrtr NFA In phs 2 o NFA onstruton tsk, onstruton o NFA grph or hnlng multpl hrtrs pr lok yl s prorm. Th lgorthm pts grph or n NFA tht prosss n hrtrs pr lok yl n outputs grph or n NFA tht prosss 2n hrtrs pr lok yl. A 2 k -hrtr NFA s thus otn usng k trtons o th lgorthm. Th lgorthm s qut smlr to th stnr trnstv grph losur lgorthm. It s rmrkl tht suh smpl lgorthm nls ln wy o proung mult-hrtr NFAs or rtrry rgxs. Th lgorthm s shown n Fgur 3. It shoul not tht th gs rrr to on lns 5 n 6 r o th orgnl nput grph or thos nsrt n lns n 2 only n not ny o th nw gs onstrut y th lgorthm. Sn th lgorthm ouls th numr o nl nos, n NFA or 2 k hrtrs wll hv 2 k nl stts, h nl stt orrsponng to hrtr poston, nlng multpl mths t rnt postons n th sm lok yl to urtly rport. I only normton out whthr th nput strng mths rgx or not s rqur (w ll ths non-mth mo ), ollowng smpltons n m; () rpl ln 2 y sl g ll to th nl no, n (2) moy ln 7 to ( g (, n) sl g t ln 2 n g (n, j) sl g t ln ). In ths s, n output NFA hs th sm numr o stts s th nput NFA. Eh g o 2 k -hrtr NFA s ll wth strng o lngth 2 k. For xmpl, n Fgur 6, trnston rom n tv stt long n g ll ours only whn th rst n son nput txt hrtrs n th urrnt lok yl r n, rsptvly. As h stp tks O() tm, th lgorthm rqurs O(n 3 ) tm, n ng th numr o stts n th nput NFA Exmpl W show n xmpl o NFA onstruton or th rgx ()*( ). Th post-orr orm * s pross y phs (Fgur 2). Fgurs 4 n 5 show th stk n th NFA grphs G to G 0, rsptvly. At th n o phs, th -hrtr NFA grph G 0 n otn. 33 Authorz lns us lmt to: IEEE plor. Downlo on Mrh 4, 2009 t 03:6 rom IEEE plor. Rstrtons pply.

4 () () (),, Fg. 6. Exmpls o 2-hrtr NFA grphs. Nxt, th ov -hrtr NFA s onvrt nto th mult-hrtr NFA y phs 2 (Fgur 3). Fgur 6 () shows th NFA grph otn t ln 2 n Fgur 3, whr sh gs show orgnl gs. Fgur 6 () shows th hl-onstrut NFA grph tr n = 2, whr w omt th orgnl gs. Ths tsks r prorm or ll o n, n thn th 2-hrtr NFA grph s shown n Fgur 6 () n otn, whr th rght nl stt oms tv whn mth ours t th rst poston o th two nput hrtr postons, th lt stt oms tv whn mth ours t th son hrtr poston. I mths our t oth postons, oth stts om tv. Smlrly, w n otn th 4-hrtr NFA rom ov 2-hrtr NFA. Thus, th 2 k -hrtr NFA n otn y k trtons o phs Rng Mthng Th rng mthng rgx mths rng o onsutv hrtrs. For xmpl, [0-9] mths ny sngl numr hrtr. Ent log or rng mthng s otn s ollows. Consr n n-t nput I ompos o ts x n- (MSB) to x 0 (LSB). Now onsr th Booln unton I C (C s n n-t onstnt, 0 C 2 n ) whh s or ll I C n 0 othrws. Frst, th Shnnon omposton o ny Booln unton n o n nputs s; n ( xn, x0 ) = xn gn ( () + xn hn ( I n rprsnts I C, thn xplotng th monoton ntur o n (n th truth tl output olumn, ll zros r t th ottom), w n rv; xn gn ( ( n = 0) n( xn, = (2) xn + hn ( x0 ) ( n = ) whr n- s th MSB o C. Smlrly, or th I C; xn + g n ( ( n = 0) n( xn, = (3) xn hn ( ( n = ) I 2 I 2 I Fg. 7. Log mplmntton o 2 I. Usng th ov qutons rursvly, on otns nt rng mthng log. For xmpl, or n = 4, th log or 2 I s shown n Fgur 7. For 8-t hrtrs, th ov thnqu, whh sms somwht ttr thn th on propos n R. [8], nls rng mthng log to ongur usng only v 4-nput LUTs (t most) or rtrry rngs Prototyp Implmntton W mplmnt our s s sotwr tool, nm Rgulr Exprsson to Vrlog NFA trnsltor (REVN). Its nput, on or mor rgxs, r onvrt nto -hrtr NFAs, whh r thn onvrt nto mult-hrtr NFAs, whh, sp n Vrlog-HDL, s th output. Th nput rgxs to REVN r sp n th stnr nx ormt, n onorm to Prl-Comptl RgEx (PCRE) [9]. Th mthrtrs pt r *, +,?,, (, ), [, -, ], ^, $,., \, {, n }. REVN hnls ntrvl quntrs, {n}, {n, }, n {n, m} n strghtorwr mnnr, or xmpl, {5} s onvrt to. Th hrtrs pt r ny hrtr wth ASCII o rom 0x20 (sp) to 0x7 ( ), th gnr hrtr typs, \, \D, \s, \S, \w, n \W, n th non-prntng hrtrs, \, \, \, \n, \r, \t, n \x (hrtr wth hx o). Th s nsnstv mth, n sngl ln / mult lns mth r lso support. Furthrmor, REVN hs n opton whh sps mth mo or non-mth mo, s sr n Ston Th HDL gnrton tsk ssntlly nvolvs trvrsng th onstrut NFA grph n or ts nos, gs n lls, spyng lp-lops, wrs n omntonl log rsptvly, n struturl Vrlog-HDL. To ongur nt hrwr log n trms o log sz, th hrtr omprtors r shr mong multpl trnstons. 4. PERFORMANCE EVALUATION In ths ston, th prormn o rgx mthng log onstrut y our propos mtho (usng REVN) s vlut y ongurng t onto FPGA. In ths vluton, to us mnngul rgxs, w xtrt thm rom Snort 2.4 rulst (unrgstr usr rls) [7]. Conrtly, w ous on ontnt, nos, urontnt, pr, n rgx optons, n xtrt 2,69 rgxs whh o not nlu ntrvl quntrs n tonl 357 rgxs (3,048 rgxs n ll) whh nlu thm. W slt 64, 28, 256, 52,,024, n 2,048 rgxs 34 Authorz lns us lmt to: IEEE plor. Downlo on Mrh 4, 2009 t 03:6 rom IEEE plor. Rstrtons pply.

5 Log usg o 2,69 rgxs (non-mth mo). Tl 2. -hrtr NFA 2-hrtr NFA 4-hrtr NFA 8-hrtr NFA #rgxs #hrs ALUT Rgstr ALUT Rgstr ALUT Rgstr ALUT Rgstr Us Utl. Us. Us Utl. Us. Us Utl. Us. Us Utl. Us % 908,044 % 96 (0%),54 % 932 (03%) 3,44 2% 964 (06%) 28,955,752 %,72,856 %,75 (00%) 2,524 2%,732 (0%) 5,459 4%,763 (02%) 256 3,877 3,23 2% 3,80 3,389 2% 3,90 (00%) 4,373 3% 3,204 (0%) 8,686 6% 3,237 (02%) 52 7,803 5,965 4% 5,88 6,34 4% 5,992 (02%) 8,046 6% 5,907 (00%) 9,595 4% 5,953 (0%),024 5,506,42 8%,340 2,072 8%,640 (03%) 4,765 0%,327 (00%) N/A N/A N/A 2,048 30,956 22,270 6% 22,6 22,697 6% 22,05 ( 99%) 26,943 9% 20,92 ( 94%) N/A N/A N/A 2,69 40,896 28,40 20% 28,278 29,303 20% 28,379 (00%) 34,46 24% 26,636 ( 94%) N/A N/A N/A Throughput [Gps] Fg Tl. Mxmum oprtng rquny,, n throughput, T, o 2,69 rgxs (non-mth mo). #rgxs #hrs -hrtr NFA 2-hrtr NFA 4-hrtr NFA 8-hrtr NFA [MHz] T [Gps] [MHz] T [Gps] [MHz] T [Gps] [MHz] T [Gps] (58%) (28%) (302%) 28, (8%) (245%) (306%) 256 3, (54%) (245%) (254%) 52 7, (64%) (22%) (30%),024 5, (67%) (250%) N/A N/A 2,048 30, (9%) (268%) N/A N/A 2,69 40, (84%) (290%) N/A N/A -hrtr NFA 2-hrtr NFA 4-hrtr NFA 8-hrtr NFA Num. o Chrtrs [K] Throughput o 2,69 rgxs (non-mth mo). rnomly rom th ov two rgx sts, n onstrut -, 2-, 4-, n 8-hrtr NFAs or h group. W trgt Altr Strtx II (EP2S80) FPGA [0] n us Qurtus II 7.2 SP [] wthout ny optmzton optons. 4.. Exprmntl Rsults Tls n 2 show th mxmum oprtng rquny, throughput, n th log usg or th 2,69 rgx st n non-mth mo. Fgur 8 shows th throughput or th sm rgxs. Th throughput s lult y multplyng th numr o ts n hrtrs pross vry lok yl y oprtng rquny. In Tls n 2, #hr (th numr o hrtrs) shows th totl hrtr ount o th rgxs xpt mthrtrs, whr th gnr hrtr typs, th non-prntng hrtrs, n rng mth r ount s on hrtr. Prntg wthn ( ) shows n nrs ompr to -hrtr NFA or h rgx group, n N/A shows unvll rsults us o vry long omplton tm n Qurtus II. Tl n Fgur 8 show tht lthough mult-hrtr NFA n mprov throughput, th vrg nrs s not proportonl to th numr o hrtrs pross ut pproxmtly 70%, 250%, n 290% or 2-, 4-, n 8-hrtr NFAs, rsptvly. Tl 2 shows tht th log usg nrss s th totl hrtr Log usg o 2,69 rgxs (mth mo). Tl 3. 2-hrtr NFA 4-hrtr NFA #rgxs #hrs ALUT Rgstr ALUT Rgstr Us Utl. Us. Us Utl. Us ,060 % 980 ( 64 ),568 %,24 ( 64 ) 28,955,939 %,843 ( 28 ) 2,590 2% 2,6 ( 28 ) 256 3,877 3,572 2% 3,446 ( 256 ) 4,60 3% 3,972 ( 256 ) 52 7,803 6,767 5% 6,504 ( 52 ) 8,605 6% 7,443 ( 52 ),024 5,506 2,978 9% 2,65 (,0) 6,003 % 4,40 (,028) 2,048 30,956 24,825 7% 24,50 (2,35) 29,95 2% 27,055 (2,045) 2,69 40,896 3,76 22% 30,936 (2,557) 38,29 27% 34,78 (2,75) ount s nrs. It lso nrss s th numr o hrtrs pross s nrs ut th rgstr usg s pproxmtly onstnt. Although our mtho wth nonmth mo n onstrut mult-hrtr NFA wthout hng n th numr o stts, th mult-hrtr NFA hs slghtly omplx trnston log, whh grs oprtng rquny o th onstrut mult-hrtr NFA. In prtulr, th 8-hrtr NFA log usg sms sproportontly hghr. Ths s u to th rhttur o ALUTs, sgnntly mor o whh r rqur or trnston log or 8-hrtr strngs. Shrng n trnston log ns to xplor to ru th log rqurmnts. Th slght rns n lp-lop ount r onsr to u to th optmzton on y Qurtus II. Nxt, Tl 3 shows th log usg or th sm st n mth mo. In ths mo, our mtho ouls th nl stts or h rgx orng to th numr o hrtrs pross. Illy, th numr o nrs rgstrs s lult y (m ) N r, whr m (m 2) s th numr o hrtrs pross n N r s th numr o rgxs. Eh vlu wthn ( ) shows th nrs o rgstrs pr nrs hrtrs pross ompr to th sm multhrtr NFA n non-mth mo (Tl 2). In Tl 3, th xtr rgstrs s lmost th sm s th numr o rgxs. Du to thm, th log usg nrss mor thn on n non-mth mo. Howvr, w onrm tht th throughput shows smlr rsults to non-mth mo. Tht 35 Authorz lns us lmt to: IEEE plor. Downlo on Mrh 4, 2009 t 03:6 rom IEEE plor. Rstrtons pply.

6 Throughput [Gps] hrtr NFA 2-hrtr NFA 4-hrtr NFA 8-hrtr NFA Num. o Chrtrs [K] Fg. 9. Throughput o 3,048 rgxs (non-mth mo). s, th normton o th mthng poston n otn wthout grton o throughput y usng our mtho. Fgurs 9 n 0 show th throughput n log usg or th 3,048 rgx st n non-mth mo. Du to REVN hnlng o ntrvl quntrs, ths rgx st nlus mor hrtrs thn th prvous on. In t, whl th prvous st nlus up to 40,896 hrtrs, ths st nlus up to 95,577 hrtrs. In ths s, lthough th throughput lns rply up to 20,000 hrtrs, t os not o so rom thn on. Th log usg nrss n proporton to th totl hrtr ount. In th s o 95,577 hrtrs, whl th log usg s mor thn 90% n 2- n 4- hrtr NFAs, th throughput hv s n 2 Gps rsptvly. Thror, our mtho s xpt to hv hgh-sp rgx mthng. Fnlly, w vlut ny o h mult-hrtr NFA y usng prormn [5] shown s Equton (4). Ths s mtr onsrng throughput n hrtr nsty, n log wth hghr prormn s mor nt log. Prormn = Throughput Dnsty (4) = Throughput Chrs / LEs Th numr o Log Elmnts (LEs) n Strtx II n otn s.25 tms th numr o ALUTs [0]. For 2,69 rgxs n non-mth mo, prormn o -, 2-, n 4-hrtr NFA r.44, 2.57, n 3.48 G/(s LE), rsptvly. In ton, or 3,048 rgxs n non-mth mo, thos o -, 2-hrtr NFA r.20 n 2.0 G/(s LE), rsptvly. In th othr rul groups xpt 8- hrtr NFA, smlr trns r not (8-hrtr NFA shows smlr vlus to -hrtr NFA). Thror, 4- hrtr NFA s urrntly th most nt. 5. CONCLUSION In ths ppr, w propos novl rgx mthng log sgn thnqu usng mult-hrtr NFAs. A smpl lgorthm or onstrutng suh NFAs or rtrry rgxs ws prsnt. Also, n nt rng mth log sgn thnqu s sr. Furthr, th propos s wr mplmnt n sotwr tool (REVN) n thr utlty ws tst on w thousn rl worl rgxs. Th rsults o prormn vluton show tht our mtho n sgnntly mprov ALUT Utlzton Fg % 80% 60% 40% 20% 0% -hrtr NFA 2-hrtr NFA 4-hrtr NFA 8-hrtr NFA Num. o Chrtrs [K] Log usg o 3,048 rgxs (non-mth mo). throughput t only rltvly most ost n trms o tonl log vn wthout turnng on optmztons whl prormng FPGA mppng. By turnng on som o thm, log sp s lkly to nrs. Thror, urthr throughput mprovmnt n xpt. Futur rtons to xtn th work nlu ruton o log sz y shrng th stts mong multpl NFA, shrng trnston log, mor tl prormn vlutons n vrous ss n on th tul systm, n nhnmnt o PCRE support vn urthr. 6. REFERENCES [] J. E. F. Frl, Mstrng Rgulr Exprssons: Powrul Thnqus or Prl n Othr Tools, O Rlly M, In., Jn [2] J. E. Hoprot, R. Motwn, n J. D. Ullmn, Introuton to Automt Thory, Lngugs n Computlty, 2n Eton, Ason-Wsly, Nov [3] R. Shu n V. K. Prsnn, Fst Rgulr Exprsson Mthng usng FPGAs, n Pro. 9th IEEE Symosum on Fl-Progrmml Custom Computng Mhns (FCCM 0), pp , Aprl 200. [4] I. Sours n D. Pnvmtktos, Fst, Lrg-Sl Strng Mth or 0Gps FPGA-s Ntwork Intruson Dtton Systm, n Pro. 3th Intrntonl Conrn on Fl Progrmml Log n Appltons (FPL 03), pp , Spt [5] C. R. Clrk n D. E. Shmml, Sll Pttrn Mthng or Hgh Sp Ntworks, n Pro. 2th IEEE Symposum on Fl-Progrmml Custom Computng Mhns (FCCM 04), pp , Aprl [6] P. Sutton, Prtl Chrtr Dong or Improv Rgulr Exprsson Mthng n FPGAs, n Pro IEEE Intrntonl Conrn on Fl-Progrmml Thnology (ICFPT 04), pp.25-32, D [7] [8] E. W. Sprzngl, CMOS Implmnttons o Rng Chk Crut, Dpt. o CSE, Wshngton Unv. Thnl Rport WUCSE , July, [9] [0] Strtx II Dv Hnook: Volum, vll t [] qts-nx.html 36 Authorz lns us lmt to: IEEE plor. Downlo on Mrh 4, 2009 t 03:6 rom IEEE plor. Rstrtons pply.

Depth First Search. Yufei Tao. Department of Computer Science and Engineering Chinese University of Hong Kong

Depth First Search. Yufei Tao. Department of Computer Science and Engineering Chinese University of Hong Kong Dprtmnt o Computr Sn n Ennrn Cns Unvrsty o Hon Kon W v lry lrn rt rst sr (BFS). Toy, w wll suss ts sstr vrson : t pt rst sr (DFS) lortm. Our susson wll on n ous on rt rps, us t xtnson to unrt rps s strtorwr.