Analysis of Bit-Split Languages for Packet Scanning and Experiments with Wildcard Matching

Monitoring traffic payloads to detect the occurrence of suspicious patterns has proven to be a useful and necessary tool for network security. Bit-splitting breaks the problem of monitoring payloads to detect such patterns into several parallel components, each of which searches for a particular bit pattern. We analyze bit-splitting as applied to AhoCorasick style string matching and present a formal treatment of bit-slicing to prove correctness and to provide bounds on the NFA to DFA conversion of the Aho-Corasick type machine used for bit-splitting. The problem can be viewed as the recovery of a special class of regular languages over product alphabets from a collection of homomorphic images. Furthermore, in an attempt to extend the flexibility and applicability of the original bit-splitting algorithm, we explore the expressiveness and limitations of bit-slicing with respect to wildcard matching applications.