Regular expression matching using TCAMs for network intrusion detection

摘要

A method is provided for implementing regular expression matching using ternary content-addressable memory devices. The method includes: receiving a set of regular expressions (REs) that specify data elements to be extracted from data packets; constructing a deterministic finite automaton (DFA) from the set of regular expressions; building a state transition table for each node of the deterministic finite automaton; combining the state transition tables into a single lookup table; and instantiating the lookup table in a ternary content-addressable memory device. Additional techniques are provided to reduce the TCAM space and improve RE matching speed.