Performance analysis of content matching intrusion detection systems

Proceedings - International Symposium on Applications and the Internet

Volumn , Issue , 2004, Pages 208-215

  Antonatos, S ^a   Anagnostakis, K G ^b   Markatos, E P ^a   Polychronakis, M ^a  

^a INSTITUTE OF COMPUTER SCIENCE   (Greece)

^b UNIVERSITY OF PENNSYLVANIA   (United States)

Author keywords

Intrusion detection; Security; Workload characterization and generation

Indexed keywords

INTRUSION DETECTION; NETWORK INTRUSION DETECTION SYSTEMS (NIDS); SECURITY; WORKLOAD CHARACTERIZATION AND GENERATION;

ALGORITHMS; COMPUTER ARCHITECTURE; INFORMATION TECHNOLOGY; MATHEMATICAL MODELS; PACKET NETWORKS; SECURITY OF DATA; TELECOMMUNICATION TRAFFIC;

COMPUTER SCIENCE;

EID: 2642555499     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SAINT.2004.1266118     Document Type: Conference Paper

References (15)

1. A. Aho and M. Corasick. Fast pattern matching: an aid to bibliographic search. Commun. ACM, 18(6):333-340, June 1975.
2. 2xB: A domain-specific string matching algorithm for intrusion detection. In Proceedings of the 18th IFIP International Information Security Conference (SEC2003), May 2003. (to appear).
3. R. Bace and P. Mell. Intrusion Detection Systems. National Institute of Standards and Technology (NIST), Special Publication 800-31, 2001.
4. R. Boyer and J. Moore. A fast string searching algorithm. Commun. ACM, 20(10):762-772, October 1977.
5. C. J. Coit, S. Staniford, and J. McAlerney. Towards faster pattern matching for intrusion detection, or exceeding the speed of snort. In Proceedings of the 2nd DARPA Information Survivability Conference and Exposition (DISCEX II), June 2002.
6. C. Courcoubetis and V. A. Siris. Measurement and analysis of real network traffic. In Proceedings of the 7th Hellenic Conference on Informatics (HCI'99), August 1999.
7. M. Fisk and G. Varghese. An analysis of fast string matching applied to content-based forwarding and intrusion detection. Technical Report CS2001-0670 (updated version), University of California - San Diego, 2002.
8. D. Gusfield. Algorithms on Strings, Trees, and Sequences: Computer Science and Computational Biology. University of California Press, 1997.
9. R. Horspool. Practical fast searching in strings. Software Practice and Experience, 10(6):501-506,1980.
10. E. P. Markatos, S. Antonatos, M. Polychronakis, and K. G. Anagnostakis. ExB: Exclusion-based signature matching for intrusion detection. In Proceedings of CCN'02, November 2002.
11. S. McCanne, C. Leres, and V. Jacobson. libpcap. Lawrence Berkeley Laboratory, Berkeley, CA, available via anonymous ftp to ftp.ee.lbl.gov.
12. L. McVoy and C. Staelin. Imbench: Portable tools for performance analysis. In Proc. of the 1996 Usenix Technical Conference, pages 279-294, Jan. 1996.
13. M. Roesch. Snort: Lightweight intrusion detection for networks. In Proceedings of the 1999 USENIX LISA Systems Administration Conference, November 1999. (software available from http://www.snort.org/).
14. Sourcefire. Snort 2.0 - Detection Revisited. http://www.snort.org/docs/ Snort_20_v4.pdf, October 2002.
15. S. Wu and U. Manber. A fast algorithm for multi-pattern searching. Technical Report TR-94-17, University of Arizona, 1994.