Regular expression rule grouping balancer

Abstract

Mechanisms are provided for intrusion detection based on regular expression matching. The mechanisms partition a regular expression (RegEx) rule set into a plurality of different partitions and distributes the plurality of different partitions to a plurality of different edge computing devices associated with a protected network of computing resources. The mechanisms route data packets of an incoming data stream to the plurality of edge computing devices, each of which processes the data packets to determine whether the data packets match RegEx rules in a partition distributed to the edge computing device. A determination is made as to whether the incoming data stream represents an intrusion based on a combination of results of the processing of the data packets by the plurality of edge computing devices.