P3FSM: Portable Predictive Pattern Matching Finite State Machine

Abstract

Signature-based network intrusion detection requires fast and reconfigurable pattern matching for deep packet inspection. In our previous work we address this problem with a hardware based pattern matching engine that utilizes a novel state encoding scheme to allow memory efficient use of Deterministic Finite Automata. In this work we expand on these concepts to create a completely software based system, P3FSM, which combines the properties of hardware based systems with the portability and programmability of software. Specifically we introduce two methods, Character Aware and SDFA, for encoding predictive state codes which can forecast the next states of our FSM. The result is software based pattern matching which is fast, reconfigurable, memory-efficient and portable.