3 ms·

Speaking as the leader of the Hyperscan project (https://github.com/01org/hyperscan https://github.com/01org/hyperscan), I'd say you might not be the only proje

Speaking as the leader of the Hyperscan project (https://github.com/01org/hyperscan https://github.com/01org/hyperscan), I'd say you might not be the only project feeling a bit neglected in the performance comparison here. It's nice to be mentioned - and even called out by name as the inventor of Teddy (!) - but we're always even more pleased when someone else measures Hyperscan, as it minimizes the prospect of us embarrassing ourselves by posting some self-serving and/or outlandish microbenchmark. Also it saves everyone time reading the obligatory Intel legal disclaimers...

rob_cameron 10y ago
We are very interested in tackling the multiple-pattern regular expression problem and will definitely want to use Hyperscan as a comparator. Any help in setting up a study with both patterns and data sets would be most appreciated!
- glangdale 10y ago
  This sounds interesting. I suspect there are many alternate approaches to multiple regex. Sadly, regex benchmarking is a sewer. There are two classes of multiple regex benchmarks: public ones and good ones, and not much intersection between the two. Synthetic pattern generation can be manipulated to say whatever you want it to say, Snort patterns aren't intended to be run simultaneously (so putting a big pile of them into a sack and running them is of arguable use), and most vendors guard proprietary signature sets closely (we have thousands, but all the good ones are customer confidential). That being said, there are some paths forward here. Let's talk.
  - rob_cameron 10y ago
    Certainly. I dropped an e-mail at the hyperscan account. By the way, if you try out icgrep and use the -DumpASM option, you may notice a very unusual characteristic: the generated code is almost completely dominated by AVX2 instructions!

3 ms·

Speaking as the leader of the Hyperscan project (https://github.com/01org/hyperscan https://github.com/01org/hyperscan), I'd say you might not be the only proje

by glangdale 10y ago

rob_cameron 10y ago
We are very interested in tackling the multiple-pattern regular expression problem and will definitely want to use Hyperscan as a comparator. Any help in setting up a study with both patterns and data sets would be most appreciated!
- glangdale 10y ago
  This sounds interesting. I suspect there are many alternate approaches to multiple regex. Sadly, regex benchmarking is a sewer. There are two classes of multiple regex benchmarks: public ones and good ones, and not much intersection between the two. Synthetic pattern generation can be manipulated to say whatever you want it to say, Snort patterns aren't intended to be run simultaneously (so putting a big pile of them into a sack and running them is of arguable use), and most vendors guard proprietary signature sets closely (we have thousands, but all the good ones are customer confidential). That being said, there are some paths forward here. Let's talk.
  - rob_cameron 10y ago
    Certainly. I dropped an e-mail at the hyperscan account. By the way, if you try out icgrep and use the -DumpASM option, you may notice a very unusual characteristic: the generated code is almost completely dominated by AVX2 instructions!