Ruler: high-speed traffic classification and rewriting using regular expressions

We describe Ruler, a flexible language for network traffic inspection and rewriting. Ruler was designed to support anonymisation at high link rates. As anonymisation requires a trade-off between privacy and usefulness of the anonymised data, flexibility is essential. For this purpose, Ruler allows matching of arbitrary traffic patterns by means of regular expressions, and construction of arbitrary output packets from fragments of the input packets. However, we show that Ruler is sufficiently general to be useful in other application domains like intrusion detection. For pattern matching, Ruler uses Deterministic Finite Automata (DFAs) which can be implemented in virtually any execution environment, including embedded hardware. Rewriting data based on regular expressions requires administration of intermediate positions in patterns, which is beyond standard DFA construction techniques. We therefore used tagged DFAs where tags are markers in partially matched patterns. Ruler is capable of handling multi-gigabit link rates on a standard processor for a large range of expressions.