Hyperscan - A Fast Multi-pattern Regex Matcher for Modern CPUs

Explore a fast multi-pattern regex matcher for modern CPUs in this USENIX conference talk. Dive into Hyperscan, a high-performance regular expression matcher designed for commodity server machines. Learn about two core techniques for efficient pattern matching: graph decomposition and SIMD-accelerated string and finite automata matching. Understand how these techniques translate regular expression matching into a series of optimized operations, eliminating duplicate processes and increasing the likelihood of fast DFA matching. Discover how Hyperscan significantly improves the performance of network security applications like Snort. Examine the effectiveness of graph analysis on real-world rules, the quality of automatically extracted keywords, and various subsystems that contribute to Hyperscan's efficiency. Gain insights into multi-string pattern matching techniques and their acceleration. Evaluate Hyperscan's performance in regex matching and its impact on real-world deep packet inspection applications.

Intro
Networking Applications with Regex Matching
Contributions
Wide Adoption of Hyperscan
Decomposition-based Matching
Key Issues with Regex Decomposition
Graph-based Regex Decomposition
Effectiveness of Graph Analysis on Real-world Rules
Quality of Automatically Extracted Keywords
How to Accelerate Pattern Matching Algorithms?
Multi-string Pattern Matching Overview
Multi-string Shift-or Matching
Other Subsystems
Evaluation of Hyperscan
Repex Matching Performance
Real-world DPI Application - Snort
Conclusion