CompactDFA: Generic state machine compression for scalable pattern matching

Anat Bremler-Barr*, David Hay, Yaron Koral

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

36 Scopus citations


Pattern matching algorithms lie at the core of all contemporary Intrusion Detection Systems (IDS), making it intrinsic to reduce their speed and memory requirements. This paper focuses on the most popular class of pattern-matching algorithms, the Aho-Corasick-like algorithms, which are based on constructing and traversing a Deterministic Finite Automaton (DFA), representing the patterns. While this approach ensures deterministic time guarantees, modern IDSs need to deal with hundreds of patterns, thus requiring to store very large DFAs which usually do not fit in fast memory. This results in a major bottleneck on the throughput of the IDS, as well as its power consumption and cost. We propose a novel method to compress DFAs by observing that the name of the states is meaningless. While regular DFAs store separately each transition between two states, we use this degree of freedom and encode states in such a way that all transitions to a specific state can be represented by a single prefix that defines a set of current states. Our technique applies to a large class of automata, which can be categorized by simple properties. Then, the problem of pattern matching is reduced to the well-studied problem of Longest Prefix Matching (LPM) that can be solved either in TCAM, in commercially available IP-lookup chips, or in software. Specifically, we show that with a TCAM our scheme can reach a throughput of 10 Gbps with low power consumption.

Original languageAmerican English
Title of host publication2010 Proceedings IEEE INFOCOM
StatePublished - 2010
Externally publishedYes
EventIEEE INFOCOM 2010 - San Diego, CA, United States
Duration: 14 Mar 201019 Mar 2010

Publication series

NameProceedings - IEEE INFOCOM
ISSN (Print)0743-166X


ConferenceIEEE INFOCOM 2010
Country/TerritoryUnited States
CitySan Diego, CA


Dive into the research topics of 'CompactDFA: Generic state machine compression for scalable pattern matching'. Together they form a unique fingerprint.

Cite this