Benchmarking of compressed DFAs for traffic identification: Decoupling data structures from models

Current network traffic analysis systems heavily rely on Deep Packet Inspection (DPI) techniques, such as Finite Automata (FA), to detect patterns carried by regular expression (regex). However, traditional Finite Automata cannot keep up with the ever-growing speed of the Internet links. Although there are a number of efficient FA compressing mechanisms for DPIs, there is no standardized or common way to evaluate and compare them. In this scenario, this paper proposes a methodology to evaluate and compare automaton models and the data-structures that materialize them. We also adapt state-of-the-art memory layouts to better fit in today´s computer architectures. Finally, we apply our methodology to most important automaton models, memory layouts, and well-known signature sets. The results show us that some memory layouts are not efficient for regexes that represent small automata and other ones which fit only with uncompressed automata. Further, we also found out that theoretical studies about memory usage from memory encodings are not as accurate as they should be.