A high throughput string matching architecture for intrusion detection and prevention

Proceedings - International Symposium on Computer Architecture

Volumn , Issue , 2005, Pages 112-122

  Tan, Lin ^a,b   Sherwood, Timothy ^a  

^a University of California   (United States)

^b UIUC   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

PREVENTION SYSTEMS; STRING MATCHING ALGORITHM;

ALGORITHMS; PERFORMANCE; SECURITY OF DATA; WIRELESS TELECOMMUNICATION SYSTEMS;

COMPUTER ARCHITECTURE;

EID: 27544490145     PISSN: 10636897     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ISCA.2005.5     Document Type: Conference Paper

References (31)

1. Commtouch ® software ltd. White paper: Recurrent pattern detection (RPD™) technology, http:www.commtouch.com/documents/Commtouch RPD White Paper.pdf.
2. A. V. Abo and M. J. Corasick. Efficient string matching: An aid to bibliographic search. Communications of the ACM, 18(6):333-340, 1975.
3. M. Aldwairi, T. Conte, and P. Franzon. Configurable string matching hardware for speedup up intrusion detection. In Workshop on Architectural Support for Security and Anti-virus (WASSA) Held in Cooperation with ASPLOS XI, Oct. 2004.
4. M. Attig, S. Dharmapurikar, and J. Lockwood. Implementation results of bloom filters for string matching. In Proceedings of the Field-Programmable Custom Computing Machines, 12th Annual IEEE Symposium on (FCCM'04), pages 322-323. IEEE Computer Society, 2004.
5. Z. K. Baker and V. K. Prasanna. A methodology for synthesis of efficient intrusion detection systems on FPGAs. In Proceedings of the Field-Programmable Custom Computing Machines, 12th Annual IEEE Symposium on (FCCM'04), pages 135-144. IEEE Computer Society, 2004.
6. Z. K. Baker and V. K. Prasanna. Time and area efficient pattern matching on FPGAs. In Proceeding of the 2004 ACM/SIGDA 12th International Symposium on Field Programmable Gale Arrays, pages 223-232. ACM Press, 2004.
7. A. Baratloo, N. Singh, and T. Tsai. Transparent run-time defense against stack smashing attacks. In Proceedings of the USENIX Security Symposium, June 2000.
8. R. S. Boyer and J. S. Moore. A fast string searching algorithm. Communications of the ACM, 20(10):761-772, 1977.
9. Y. Cho and W. Mangione-Smith. Deep packet filter with dedicated logic and read only memories. In IEEE Symposium on Field-Programmable Custom Computing Machines, Apr. 2004.
10. Y. H. Cho, S. Navab, and W. H. Mangione-Smith. Specialized hardware for deep network packet filtering. In 12th International Comerence on Field-Programmable Logic and Applications, 2002.
11. C. R. Clark and D. E. Schimmel. Efficient reconfigurable logic circuits for matching complex network intrusion detection patterns. In 13th International Conference on Field Programmable Logic and Applications, Sept. 2003.
12. S. A. Crosby and D. S. Wallach. Denial of service via algorithmic complexity attacks. In Proceedings of USENIX Annual Technical Conference, June 2003.
13. S. Dharmapurikar, M. Attig, and J. Lockwood. Deep packet inspection using parallel bloom filters. Micro, IEEE, 24(1):52-61, January - February 2004.
14. M. Fisk and G. Varghese. Applying fast string matching to intrusion detection. Technical Report In preparation, successor to UCSD TR CS2001-0670, University of California, San Diego.
15. M. Gokhale, D. Dubois, A. Dubois, M. Boorman, S. Poole, and V. Hogsett. Granidt: Towards gigabit rate network intrusion detection technology. In Proceedings of the Reconfigurable Computing Is Going Mainstream, 12th International Conference on Field-Programmable Logic and Applications, pages 404-413. Springer-Verlag, 2002.
16. P. Gupta and N. McKeown. Algorithms for packet classification. IEEE Network Magazine, March 2001.
17. B. L. Hutchings, R. Franklin, and D. Carver. Assisting network intrusion detection with reconfigurable hardware. In Proceedings of the 10 th Annual IEEE Symposium on Field-Programmable Custom Computing Machines (FCCM '02), page 111. IEEE Computer Society, 2002.
18. K. Mai, T. Paaske, N. Jayasena, R. Ho, W. Dally, and M. Horowitz. Smart memories: A modular reconfigurable architecture. In Annual International Symposium on Computer Architecture, June 2000.
19. B. J. McKenzie. Fast peephole optimization techniques. Softw. Pract. Exper., 19(12): 1151-1162, 1989.
20. I. M. Research. Intrusion detection/prevention product revenue up 9% in 1Q04. Technical report, June 2004.
21. M. Roesch. Snort - lightweight intrusion detection for networks. In Proceedings of LISA'99: 13th Systems Administration Conference, pages 229-238, Nov. 1999.
22. M. Sanchez, E. Biersack, and W. Dabbous. Survey and taxonomy of IP address lookup algorithms. IEEE Network Magazine, 15(2):8-23, 2001.
23. P. Shivakumar and N. Jouppi. CACTI 3.0: An integrated cache timing, power, and area model. Technical Report WRL-2001-2, HP Labs Technical Reports, Dec. 2001.
24. I. Sourdis and D. Pnevmatikatos. Pre-decoded CAMs for efficient and high-speed NIDS pattern matching. In Proceedings of the Field-Programmable Custom Computing Machines, 12th Annual IEEE Symposium on (FCCM'04), pages 258-267. IEEE Computer Society, 2004.
25. V. Srinivasan and G. Varghese. Fast address lookups using controlled prefix expansion. ACM Transactions on Computer Systems, 7(1): 1-40, Feb. 1999.
26. G. V. Sumeet Singh, Cristian Estan and S. Savage. Automated worm fingerprinting. In Proceedings of the ACM/USENIX Symposium on Operating System Design and Implementation (OSDI), Dec. 2004.
27. S. Swanson, K. Michelson, A. Schwerin, and M. Oskin. Wavescalar. In 36th International Symposium on Microarchitecture, Dec. 2003.
28. A. S. Tanenbaum, H. van Staveren, and J. W. Stevenson Using peephole optimization on intermediate code. ACM Trans. Program. Lang. Syst., 4(1):21-36, 1982.
29. M. B. Taylora, W. Lee. S. Miller, D. Wentzlaff, I. Bratt, B. Greenwald, Henry, Hoffmann, P. Johnson, J. Kim, J. Psota, A. Saraf, N. Shnidman, V. Strumpen, M. Frank, S. Amarasinghc, and A. Agarwal. Evaluation of the Raw microprocessor: An exposed-wire-delay architecture for ILP and streams. In Annual International Symposium on Computer Architecture, June 2004.
30. N. Tuck, T. Sherwood, B. Calder, and G. Varghese. Deterministic memory-efficient string matching algorithms for intrusion detection. In the 23rd Conference of the IEEE Communications Society (Infocomm), Mar. 2004.
31. J. Xu, Z. Kalbarczyk, S. Patel, and R. K. lyer. Architecture support for defending against buffer overflow attacks. In Workshop on Evaluating and Architecting Systems for Dependability, June 2002.