A Comparative Study on DFA-Based Pattern Matching for Deep Packet Inspection

Most of the network security applications in today´s networks are based on Deep Packet Inspection (DPI). It is a form of computer network packet filtering that examines not only the header portion but also the payload part of a packet as it passes through an inspection point, searching for protocol noncompliance, viruses, Spam, intrusions or some predefined criteria to decide if the packet can pass it or it needs to be routed to a different destination. Most of the systems that perform deep packet inspection implement basic string matching algorithms to match packets against large but finite strings. However, there is growing interest in the use of regular expression-based pattern matching, since regular expressions offer superior expressive power. DFA is employed to implement regular expression matching. DFA representations of a regular expression sets in network applications require large amounts of memory, limiting their practical application. This paper presents an analysis of different compact representation of DFA such as D²FA, δFA, δ²FA.