Apparatus and method for enhancing regular expression search performance through cost-based optimization technique

An apparatus for enhancing regular expression search performance through a cost-based optimization technique, the apparatus comprising:

• a policy database that stores a malicious payload detection rule including a regular expression character string;
• a regular expression extraction processor that generates a group of regular expression character strings included in each policy from the policy database;
• a regular expression fragment processor that splits each of the regular expression character strings extracted by the regular expression extraction processor in accordance with a fragmentation rule, unifies regular expression fragments, and generates a regular expression fragment table;
• a regular expression normalization processor that generates an optimized regular expression fragment table by performing an optimization process on each of the regular expression fragments of the regular expression fragment table generated by the regular expression fragment processor;
• a cost calculation engine processor that determines a cost for each of the regular expression fragments by applying a sample traffic to the regular expression fragment table optimized by the regular expression normalization processor;
• a decision tree generation processor that generates a decision tree based on cost information calculated by the cost calculation engine processor with respect to each fragment of the regular expression fragment table optimized by the regular expression normalization processor;
• and
• a pattern matching engine processor that configures a search engine performing policy pattern matching by applying the decision tree.