Re: [jflex-users] merge more than one DFA into one

[Gerwin K. <ger...@ni...>]

I'm not sure what your question is. I doubt that anti-virus tools are
written with JFLex, but if they are, they just need to have each pattern
as a separate expression, not joined with |.

So, you write not "a|b  { some action }", but

a  { some action for a }
b  { some action for b }

If you are implementing your own DFA/regexp matcher, you need to
treat the final states with different actions separate in the minimisation
and NFA->DFA phase and keep track of what belongs to what.
Nothing magic there.

Cheers,
Gerwin

Johnson Wang wrote:
> But, if so, how does the anti-virus work? They must find the virus and detect what kind of virus they are. Is it possible to modify the structure of NFA/DFA to make it have that function? 
> 
> --------------------------------------------------
> From: "Gerwin Klein" <ger...@ni...>
> Sent: Monday, August 18, 2008 9:27 AM
> To: "Johnson Wang" <ins...@gm...>
> Cc: <jfl...@li...>
> Subject: Re: [jflex-users] merge more than one DFA into one
> 
>> Johnson Wang wrote:
>>> If I use JFlex to merge more than one DFA into one( use '|' connect each 
>>> other), then about the final DFA, how to know which regular 
>>> expression does the final states comes from? 
>>> For instance:
>>> Regular Expression1(r1):  a|b
>>> Regular Expression2(r2):  a|c
>>> We use '|' to connect these two regular expressions:  a|b|a|c
>>> Then, about the final states, how do we know the states comes from r1 or r2?
>> There is no general way to know. If you want to distinguish two expressions, you 
>> should match them separately in JFLex, otherwise the minimisation algorithm will 
>> collapse the final states into one.
>>
>> There is no speed penalty for matching them separately in JFlex (unless the two 
>> DFAs have thousands of state).
>>
>> Cheers,
>> Gerwin
>>
>>