A regular expression matching circuit: Decomposed non-deterministic realization with prefix sharing and multi-character transition

This paper shows a compact realization of regular expression matching circuits on FPGAs. First, the given regular expression is converted into a non-deterministic finite automaton (NFA) by the modified McNaughton-Yamada method. Second, to reduce the number of the states in the NFA, prefixes for the NFA are shared. Also, the NFA is converted into the NFA with multicharacter transition (MNFAU: Modular non-deterministic finite automaton with unbounded string transition). Third, the MNFAU is decomposed into the transition string part and the state transition part. The transition string part is represented by the Aho-Corasic deterministic finite automaton (AC-DFA), and it is implemented by an off-chip memory and a register. On the other hand, the state transition part is implemented by a cascade of logic cells (LCs) and the the interconnection on the FPGA. We implemented the regular expressions for SNORT (an open source intrusion detection system) on a Xilinx FPGA. Experimental results showed that, the embedded memory size per a character of the MNFAU is reduced to 0.2% of the pipelined DFA; 4.2% of the bit-partitioned DFA; 41.0% of the MNFAU(3); and 71.4% of the MNFAU without prefix sharing. Also, the number of LCs per a character of the MNFAU is reduced to 0.9% of the pipelined DFA; 15.6% of the NFA; and 80.0% of MNFAU without prefix sharing.