APPREAL: Tool for Approximate Reduction of Finite Automata from Snort Rules

APPREAL is a Python prototype tool used to obtain experimental results for a TACAS '18 paper on approximate reduction of nondeterministic finite automata. The artifact includes source code, the Netbench tool for transforming PCREs into NFAs, and regular expressions collected from Snort intrusion detection rules. It is prepared to run on a specified virtual machine, with 2048 MiB of memory recommended for reproducing core results.

Use Cases

• Reproducing experiments on automata reduction for high-speed network intrusion detection based on the TACAS '18 paper methodology.
• Testing approximate reduction procedures on NFAs derived from Snort's Perl Compatible Regular Expressions.
• Benchmarking size and error trade-offs in reduced automata using the provided experimental setup and network traffic PCAP pre-processing tools.

Strengths

• Includes the complete experimental setup and source code from a peer-reviewed TACAS '18 conference paper.
• Provides specific memory recommendations (2048 MiB and 8192 MiB) for reproducing different result tables from the paper.
• Contains collected regular expressions from Snort, a popular network intrusion detection system.

Limitations

• Row count is unknown, which may limit suitability assessment for data-centric analysis.
• Column-level documentation is absent; field semantics must be inferred from the source code after download.
• Last update date is unknown; freshness unverified.

Provenance

Source

Milan Češka and co-authors, associated with the TACAS '18 paper.

Collection Method

Created as a software artifact to accompany academic research.