3 ms·
We are very interested in tackling the multiple-pattern regular expression problem and will definitely want to use Hyperscan as a comparator. Any help in setti
by rob_cameron 10y ago
We are very interested in tackling the multiple-pattern regular expression problem and will definitely want to use Hyperscan as a comparator.
Any help in setting up a study with both patterns and data sets would be most appreciated!
- glangdale 10y agoThis sounds interesting. I suspect there are many alternate approaches to multiple regex. Sadly, regex benchmarking is a sewer. There are two classes of multiple regex benchmarks: public ones and good ones, and not much intersection between the two. Synthetic pattern generation can be manipulated to say whatever you want it to say, Snort patterns aren't intended to be run simultaneously (so putting a big pile of them into a sack and running them is of arguable use), and most vendors guard proprietary signature sets closely (we have thousands, but all the good ones are customer confidential). That being said, there are some paths forward here. Let's talk.
- rob_cameron 10y agoCertainly. I dropped an e-mail at the hyperscan account. By the way, if you try out icgrep and use the -DumpASM option, you may notice a very unusual characteristic: the generated code is almost completely dominated by AVX2 instructions!