A SIMD instruction executes the same operation on multiple data in parallel.
A SIMD operation is performed on multiple lanes of two SIMD registers independently, and the results are stored in the third register. Modern CPU supports a number of SIMD instructions that can work on specialized vector registers (SSE, AVX, etc.). The latest AVX512 instructions support up to 512-bit operations simultaneously.
一次 SIMD 操作是對兩個 SIMD 寄存器的多個通道獨立進行，然后結果存儲在第三個寄存器中。現代 CPU 支持可以在專用向量寄存器（SSE、AVX 等）上運行的 SIMD 指令。最新的 AVX512 指令最多可同時支持 512 位操作。
Hyperscan 超掃描算法：用于現代CPU的“快速-多模式”正則表達式匹配器
Hyperscan: A Fast Multi-pattern Regex Matcher for Modern CPUs
Regular expression matching serves as a key functionality of modern network security applications. Unfortunately, it often becomes the performance bottleneck as it involves
compute-intensive scan of every byte of packet payload. With trends towards increasing network bandwidth and a large ruleset of complex patterns, the performance re-quirement gets ever more demanding. In this paper, we present Hyperscan, a high performance regular expression matcher for commodity server machines.?
Hyperscan employs two core techniques for efficient pattern matching.?
- First, it exploits graph decomposition that translates regular expression matching into a series of string and finite automata matching. Unlike existing solutions, string matching becomes a part of regular expression matching, eliminating duplicate operations. Decomposed regular expression components also increase the chance of fast DFA matching as they tend to be smaller than the original pattern.
- Second, Hyperscan accelerates both string and finite automata matching using SIMD operations, which brings substantial through-put improvement.?
Our evaluation shows that Hyperscan improves the performance of Snort by a factor of 8.7 for a real traffic trace.
Deep packet inspection (DPI) provides the fundamental functionality for many middlebox applications that deal with L7 protocols, such as intrusion detection systems (IDS)。
Despite continued efforts, the performance of regex matching on a commodity server still remains impractical to directly serve today’s large network bandwidth. Instead, the de-facto best practice of high-performance DPI generally employs multi-string pattern matching as a pre-condition for expensive regex matching.?
This hybrid approach (or prefiltering) is attractive as multi-string matching is known to outperform multi-regex matching by two orders of magnitude , and most input traffic is innocent, making it more efficient to defer a rigorous check. For example, popular IDSes like Snort and Suricata specify a string pattern per each regex for prefiltering, and launch the corresponding regex matching only if the string is found in the input stream.
盡管一直在努力，商品服務器上的正則表達式匹配的性能仍然不適合直接服務于當今的大網絡帶寬。相反，高性能DPI的實際最佳實踐，通常采用多字符串模式匹配作為昂貴的正則表達式匹配的先決條件。
這種混合方法（或預過濾）很有吸引力，因為眾所周知，多字符串匹配的性能比多正則表達式匹配高出兩個數量級，而且大多數輸入流量都是無辜的，這使得推遲嚴格檢查更加有效。例如，像Snort和Suricata這樣的流行IDSes，為每個正則表達式指定一個用于預過濾的字符串模式，并且，只有在輸入流中找到字符串時，才啟動相應的正則表達式匹配。
However, the current prefilter-based matching has a number of limitations.?
First, string keywords are often defined manually by humans. Manual choice does not scale as the ruleset expands over time, and improper keywords would waste CPU cycles on redundant regex matching.?
Second, string matching and regex matching are executed as two separate tasks, with the former leveraged only as a trigger for the latter. This results in duplicate matching of the string keywords when the corresponding regex matching is executed.?
Third, current regex matching typically translates an entire regex into a single finite automaton (FA). If the number of deterministic finite automaton (DFA) states becomes too large, one must resort to a slower non-deterministic finite automaton (NFA) for matching of the whole regex.
然而，當前基于前置濾波器的匹配有許多限制。
首先，字符串關鍵字，通常由人手工定義。手動選擇不會隨著規則集隨著時間的推移而擴展，不正確的關鍵字，會在冗余的正則表達式匹配上浪費CPU周期。
其次，字符串匹配和正則表達式匹配，作為兩個獨立的任務執行，前者僅作為后者的觸發器。當執行相應的正則表達式匹配時，這會導致字符串關鍵字的重復匹配。
第三，當前正則表達式匹配，通常將整個正則表達式轉換為單個有限自動機（FA）。如果確定型有窮自動機（DFA）狀態的數目過大，則必須使用較慢的非確定型有窮自動機（NFA）來匹配整個正則表達式。
Hyperscan, a high performance regex matching system that exploits regex decomposition as the first principle. Regex decomposition splits a regex pattern into a series of disjoint string and FA components。
This translates regex matching into a sequence of decomposed subregex matching whose execution and matching order is controlled by fast string matching.
超掃描，一個高性能正則表達式匹配系統，利用正則表達式分解作為第一原則。正則表達式分解將正則表達式模式拆分為一系列不相交的字符串和FA組件。
這將正則表達式匹配轉換為分解的子正則表達式匹配序列，其執行和匹配順序由快速字符串匹配控制。
This design brings a number of benefits.?
First, our regex decomposition identifies string components automatically by performing rigorous structural analyses on the NFA graph of a regex. Our algorithm ensures that the extracted strings are pre-requisite for the rest of regex matching.
Second, string matching is run as a part of regex matching rather than being employed only as a trigger. Unlike the prefilter-based design, Hyperscan keeps track of the state of string matching throughout regex matching and avoids any redundant operations.?
Third, FA component matching is executed only when all relevant string and FA components are matched. This eliminates unnecessary FA component matching, which allows efficient CPU utilization.?
Finally, most decomposed FA components tend to be small, so they are more likely to be able to be converted to a DFA and benefit from fast DFA matching.
這種設計帶來了許多好處。
首先，正則表達式分解，通過對正則表達式的NFA圖，執行嚴格的結構分析，來自動識別字符串組件。算法確保提取的字符串是正則表達式匹配其余部分的先決條件。
其次，字符串匹配，作為正則表達式匹配的一部分運行，而不是僅作為觸發器使用。與基于前置過濾器的設計不同，Hypercan在整個正則表達式匹配過程中，跟蹤字符串匹配的狀態，并避免任何冗余操作。
第三，FA組件匹配，僅在匹配所有相關字符串和FA組件時執行。這消除了不必要的FA組件匹配，從而允許高效的CPU利用率。
最后，大多數分解的FA組件往往很小，因此它們更有可能轉換為DFA，并受益于快速的DFA匹配。
Beyond the benefits of regex decomposition, Hyperscan also brings a significant performance boost with single-instruction-multiple-data (SIMD)?accelerated pattern matching algorithms.
Source code at https://github.com/intel/hyperscan
參考資料：
https://github.com/intel/hyperscan
Hyperscan is a high-performance multiple regex matching library. It follows the regular expression syntax of the commonly-used libpcre library, but is a standalone library with its own C API.
Hyperscan uses hybrid automata techniques to allow simultaneous matching of large numbers (up to tens of thousands) of regular expressions and for the matching of regular expressions across streams of data.
Hyperscan is typically used in a DPI library stack.
https://www.usenix.org/sites/default/files/conference/protected-files/nsdi19_slides_wang_xiang.pdf
https://www.youtube.com/watch?v=Le67mP-jIa8
https://www.usenix.org/conference/nsdi19/presentation/wang-xiang
https://www.usenix.org/system/files/nsdi19-wang-xiang.pdf
http://intel.github.io/hyperscan/dev-reference/getting_started.html#very-quick-start
