Hyperscan

Hyperscan: High-Performance Regex Matching Library

A high-performance regular expression matching library, leveraging modern processor architectures for accelerated pattern matching on streaming input data.

What is Hyperscan?

Hyperscan is an open-source, high-performance regular expression matching library created by Intel. It allows software developers to build high-speed pattern matching applications by taking advantage of the parallelism and vector processing capabilities of modern processors.

Hyperscan works by compiling regular expressions into executable code rather than interpreting them at runtime. This compiled code is optimized specifically for the host processor, whether it's an Intel or AMD x86 processor, an ARM processor, or a PowerPC processor. The specialized code uses SIMD instructions and multiple execution units inside these processors to scan input streams rapidly against large rule sets.

Some key benefits and features of Hyperscan include:

• High throughput due to runtime code generation and optimization for specific hardware
• Support for studying regular expressions to identify commonalities and optimize performance
• Just-in-time compilation of expression databases allows optimization based on runtime host system
• Easy integration with developer's choice of programming language and environment
• Open source library with community support and development

Hyperscan is commonly used for network intrusion detection, financial trade analysis, log analysis, bioinformatics, and other high volume data processing applications. The library is bundled with the Snort and Suricata intrusion detection systems and has been integrated into products from companies like Cisco, Facebook, Oracle, IBM, and Sophos.

Hyperscan Features

Official Links