Regular expression rule grouping balancer

A computer program product comprising a computer readable storage medium having a computer readable program stored in a data processing system, that causes the data processing system to:

• partition a regular expression (RegEx) rule set into a plurality of different partitions;
• wherein partitioning the RegEx rule set comprises:
• determining a number of states in each RegEx rule of the RegEx rule set;
• predicting a number of saved states that are to be saved by compiling at least two RegEx rules in the RegEx rule set together;
• and
• inputting into at least one optimization algorithm the number of states in each RegEx rule of the RegEx rule set, the number of saved states, and a number of desired partitions in order to generate partitions based on the number of states in each RegEx rule, the number of saved states, and the number of desired partitions, wherein predicting the number of saved states comprises, for each pairing of a RegEx rule in the RegEx rule set to each other RegEx rule in the RegEx rule set, computing a length of a longest common sequence, and wherein an average length of the lengths of the longest common sequences is determined and returned as the number of saved states that are input into the at least one optimization algorithm;
• distribute the plurality of different partitions to a plurality of different edge computing devices associated with a protected network of computing resources, wherein the plurality of different edge computing devices comprise smart network interface cards;
• route data packets of an incoming data stream to the plurality of edge computing devices, wherein each edge computing device in the plurality of edge computing devices, processes the data packets to determine whether the data packets match RegEx rules in a partition distributed to the edge computing device;
• and
• determine whether the incoming data stream represents an intrusion based on a combination of results of the processing of the data packets by the plurality of edge computing devices.

An apparatus comprising:

• at least one processor;
• and
• at least one memory coupled to the at least one processor, wherein the at least one memory comprises instructions which, when executed by the at least one processor, cause the at least one processor to:
• partition a regular expression (RegEx) rule set into a plurality of different partitions;
• wherein partitioning the RegEx rule set comprises:
• determining a number of states in each RegEx rule of the RegEx rule set;
• predicting a number of saved states that may be saved by compiling at least two RegEx rules in the RegEx rule set together;
• and
• inputting into at least one optimization algorithm the number of states in each RegEx rule of the RegEx rule set, the number of saved states, and a number of desired partitions in order to generate partitions based on the number of states in each RegEx rule, the number of saved states, and the number of desired partitions, wherein predicting the number of saved states comprises, for each pairing of a RegEx rule in the RegEx rule set to each other RegEx rule in the RegEx rule set, computing a length of a longest common sequence, and wherein an average length of the lengths of the longest common sequences is determined and returned as the number of saved states that are input into the at least one optimization algorithm;
• distribute the plurality of different partitions to a plurality of different edge computing devices associated with a protected network of computing resources, wherein the plurality of different edge computing devices comprise smart network interface cards;
• route data packets of an incoming data stream to the plurality of edge computing devices, wherein each edge computing device in the plurality of edge computing devices, processes the data packets to determine whether the data packets match RegEx rules in a partition distributed to the edge computing device;
• and
• determine whether the incoming data stream represents an intrusion based on a combination of results of the processing of the data packets by the plurality of edge computing devices.