Real-time regex matching with apache spark

Contributing USMA Research Unit(s)

Cyber Research Center, Electrical Engineering and Computer Science


Network Monitoring Systems (NMS) are an important part of protecting Army and enterprise networks. As governments and corporations grow, the amount of traffic data collected by NMS grows proportionally. To protect users against emerging threats, it is common practice for organizations to maintain a series of custom regular expression (regex) patterns to run on NMS data. However, the growth of network traffic makes it increasingly difficult for network administrators to perform this process quickly. In this paper, we describe a novel algorithm that leverages Apache Spark to perform regex matching in parallel. We test our approach on a dataset of 31 million Bro HTTP log events and 569 regular expressions provided by the Army Engineer Research & Development Center (ERDC). Our results indicate that we are able to process 1, 250 events in 1.047 seconds, meeting the desired definition of real-time.

Publication Date


Publication Title

2017 IEEE High Performance Extreme Computing Conference (HPEC)

Document Type


Record links to items hosted by external providers may require fee for full-text.