Researching Of Regular Expressions Matching Technology For Network Flow Identification

With the computer and Internet applications continues to expand and further, network flow identification has attracted more and more people to research. Identifying classification of network flow quickly and accurately has great practical significance on network security, business accounting, purification networks, network operation and management.This paper studies regular expression matching technology for network flow identification. Because the current application system is mainly using NFA-based matching technology which matching slowly, people focus more on the DFA-based matching technology. DFA has the O (1) time in the state transition, but at the same time it has a defect that storage space of DFA has brought a rapid expansion. The current solution is to compress state transition table of DFA in order to achieve faster matching speed and with less storage space.Specifically, this work includes:Researching regular expression matching technology and the classical protocol identification system named L7filter. The principle and implementation of L7filter is described. L7filter is based on iptables extension module mechanism.It's regular expression template which described characteristic of network protocol is a foundation of application system.Researching construction of a large multi-DFA from regular expressions and compression method.Proposed a dynamic compression algorithm based on Run-length encoding which can compress DFA to less than 10% of original space, and applied in network flow identification system.Designed and implemented the network flow identification system based on DFA. It used regular expressions matching technology to ensure the accuracy and ease of scalability.It's matching engineer base one DFA makes a highly processing speed.