This document discusses the use of finite state machines for efficient string matching. It describes how a non-deterministic finite automaton (NFA) can be used to match patterns against a payload by transitioning between states based on character inputs. The document notes that NFAs can have redundant matches and proposes converting the NFA to a deterministic finite automaton (DFA) by eliminating failure functions and copying transition information to remove redundancies. This improves performance by avoiding unnecessary state transitions during matching.

2. REF PDF
Efficient String Matching: An Aid to Bibliographic Search (1971

3. AC PRO
Multiple match with one pass

4. AC INTRO
Goto
 Define state transition over each payload
character
 g(0,h)=1
Fail
 While go to state transition fail, traverse
the fail state
Output
 The matched string

5. GOTO FUNCTION
Set according to state graph
 He
 She
 His
 Hers

6. FAIL STATE/OUTPUT
Fail state
 Transition fail take the fail state
Output
 Construction phase
 Union fail state’s output
 Ex: state 5 output = {She} and {he}

7. FAIL STATE CONSTRUCTION
Trivial
 For each state,
1. remove the 1st char,
2. matching again until the valid transition
3. Repeat 1
AC
 All init F(s) =0
 F({SD1})=0
 f(1)=f(3)=0
 f(2)=g(f(1),e)=g(0,e)=0
 F(6)=g(f(1),i)=g(0,i)=0
 F(4)=g(f(3),h)=g(0,h)=1
 …
 F(5)=g(f(4),e)=g(1,e)=2
 F(state)=g(f(previous state), symbol)
 Look for the valid transition in the fail state chain of previous state , ex, if f(5)=g(1,e) is
invalid, use g(f(1),e)=g(0,e)=0

8. NFA MATCH EXAMPLE 1

9. NFA MATCH EXAMPLE 2
Fail state
 F(5)=2
 F(2)=10
 Payload: shexam
 3 ->4 ->5->2->10->11->12->13

10. PERFORMANCE DRAWBACK/ WASTE OF NFA
Example 1:
 Payload shis
 3,4,1,6,7
 Unnecessary try on 1->2
 Already test on 4->5 fail
Example 2:
 Traverse many fail state if pattern are suffix of
other patterns
 Cost 2n at maximum when the payload length=n
 Prove??

11. NEXT MOVE FUNCTION
ELIMINATE FAILURE FUNCTION
Copy the fail state’s transition, remove the
redundant one

12. ELIMINATE FAILURE FUNCTION
NEXT MOVE FUNCTION (DFA)
State 5:
 R->8 (state 2)
 X->11 (state 10)
 H->1, S->3, E->10 (state 0)
 . ->0
State 4:
 e->5
 X->11 (state 10)
 H->1, S->3, E->10 (state 0)
 . ->0

13. NFA VS DFA
NFA
 Matching info more simple
 Possible cause duplicated char match
DFA
 Lots of valid state could cause lots state vector, especially..
 The root transition will add into all state’s valid transition
 The bigger state DB, the possible higher cache miss

15. FAIL STATE CONSTRUCTION
All init F(s) =0
F(10)=f(1)=f(3)=0
F(2)=g(f(1),e)=g(0,e)=10
F(6)=g(f(1),i)=g(0,i)=0
F(4)=g(f(3),h)=g(0,h)=1
…
F(5)=g(f(4),e)=g(1,e)=2

16. FINITE STATE MATCHING ALGO. ON STRING
MATCHING
Pro
 The matched state represents the “matched” payload, no need to buffer the
payload to implement extra 2nd pass matching
Con
 Compare each input character, matching speed linear to the payload
 Signature size grows proportional to the pattern number/length