With the rapid development of network bandwidth, the matching-performance of regular expression is gradually of crucial importance for networking security. There are many hardware acceleration designs of regular expression matching on the basis of NFA and DFA, of which NFA designs require more logic circuit resources while the DFA designs more memory resources. However, because there are too many states and transition edges in DFA, the performance of DFA is much inferior to the performance of NFA. In this paper we designed a DFA regular expression matching algorithm fully based on FPGA logic circuit. The algorithm exploits the feature of DFA that many transitions for a state may have the same next state pointer and setting a default transition for each state of DFA will result in the reduction of logic circuit and the simplification of the electronic circuit. To evaluate performance, this DFA algorithm was mapped onto the Altera Cyclone FPGA, and got the experimental results based on the L7-filter rule set. The performance of the DFA algorithm acquired an approximate performance compared to the NFA algorithm. Experimental result shows that, compared with the NFA algorithm, in the improved DFA plan, 10% rules got a higher throughput, reaching 60% in the best case; while 62% rules cost less logic resources, saving 87% logic resources in the best case.
A few bits are enough - ASIC friendly Regular Expression matching for high speed network security systems