Benchmarking of Compressed DFAs for Traffic Identification: Decoupling Data Structures from Models
Current network traffic analysis systems heavily rely on Deep Packet Inspection (DPI) techniques, such as Finite Automata (FA), to detect patterns carried by regular expression (regex). However, traditional Finite Automata cannot keep up with the ever-growing speed of the Internet links. Although there are a number of efficient FA compressing mechanisms for DPIs, there is no standardized or common way to evaluate and compare them. In this scenario, this paper proposes a methodology to evaluate and compare automaton models and the data-structures that materialize them. The authors also adapt state-of-the-art memory layouts to better fit in today's computer architectures. Finally, they apply their methodology to most important automaton models, memory layouts, and well-known signature sets.