Aho-Corasick Algorithm

This might be relevant here: there is a Rust implementation of this algorithm by BurntSushi [1], and discussion [2] about the performances and Hyperscan [3] in the case of Suricata [4]. HyperScan being regular expression matching library using AMD64 SIMD instructions by Intel. HyperScan is in low maintenance mode, but there is a maintained fork which is compatible with more architectures: Vectorscan [5]

[1] https://github.com/BurntSushi/aho-corasick/

[2] https://github.com/BurntSushi/aho-corasick/discussions/136

[3] https://github.com/intel/hyperscan

[4] https://github.com/OISF/suricata

[5] https://github.com/VectorCamp/vectorscan

Still remember when first heard Aho-Corasick from the Snort IDS mailing list circa 2002. This paper described the optimization of Snort detection engine based on Aho-Corasick in the later version of Snort [1]. Not sure though which algorithm that the latest Snort 3 IDS is using for its detection engine [2].

[1] Optimizing Pattern Matching for Intrusion Detection:

https://www.semanticscholar.org/paper/Optimizing-Pattern-Mat...

[2] Snort:

https://www.snort.org/