Towards software-based signature detection for intrusion prevention on the network card

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 3858 LNCS, Issue , 2006, Pages 102-123

  Bos, H ^a   Huang, Kaiming ^b  

^a VU UNIVERSITY AMSTERDAM   (Netherlands)

^b XIAMEN UNIVERSITY   (China)

Author keywords

Distributed firewall; Network processors

Indexed keywords

ALGORITHMS; COMPUTER CRIME; COMPUTER SOFTWARE; COMPUTER SYSTEM FIREWALLS; LOCAL AREA NETWORKS; PROGRAM PROCESSORS; SECURITY OF DATA; TELECOMMUNICATION NETWORKS;

DISTRIBUTED FIREWALLS; NETWORK CARDS; NETWORK PROCESSORS; SIGNATURE DETECTION SYSTEM;

ELECTRONIC DOCUMENT IDENTIFICATION SYSTEMS;

EID: 33745643365     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/11663812_6     Document Type: Conference Paper

References (30)

1. Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., Weaver, N.: The spread of the Sapphire/Slammer worm, technical report. Technical report, CAIDA (2003) http://www.caida.org/outreach/papers/2003/sapphire/.
2. Bellovin, S.M,: Distributed firewalls. Usenix; login:, Special issue on Security (1999) 37-39
3. Ioannidis, S., Keromytis, A.D., Bellovin, S.M., Smith, J.M.: Implementing a distributed firewall. In: CCS '00: Proceedings of the 7th ACM conference on Computer and communications security, ACM Press (2000) 190-199
4. Clark, C., Lee, W., Schimmel, D., Contis, D., Koné, M., Thomas, A.: A hardware platform for network intrusion detection and prevention. In: Third Workshop on Network Processors and Applications, Madrid, Spain (2004)
5. Toelle, J., Niggemann, O.: Supporting intrusion detection by graph clustering and graph drawing. In: Proc. RAID'00, Toulouse, France (2000)
6. Barford, P., Kline, J., Plonka, D., Ron, A.: A signal analysis of network traffic anomalies. In: SIGCOMM Internet Measurement Workshop, Miami, FLA (2003)
7. Krishnamurthy, B., Sen, S., Zhang, Y., Chen, Y.: Sketch-based change detection: Methods, evaluation, and applications. In: SIGCOMM Internet Measurement Workshop, Miami, FLA (2003)
8. Yegneswaran, V., Barford, P., Ullrich, J.: Internet intrusions: Global characteristics and prevalence. In: Proc. of ACM SIGMETRICS. (2003)
9. Estan, C., Savage, S., Varghese, G.: Automatically inferring patterns of resource consumption in network traffic. In: Proc. of SIGCOMM'03. (2003)
10. Aho, A.V., Corasick, M.J.: Efficient string matching: an aid to bibliographic search. Communications of the ACM 18 (1975) 333-340
11. Paxson, V.: Bro: A system for detecting network intruders in real-time. Computer Networks 31(23-24) (1999) 2435-2463
12. Jung, J., Paxson, V., Berger, A.W., Balakrishnan, H.: Fast Portscan Detection Using Sequential Hypothesis Testing. In: IEEE SP'04, Oakland, CA (2004)
13. Kompella, R.R., Singh, S., Varghese, G.: On scalable attack detection in the network. In: SIGCOMM Internet measurement conference. (2004) 187-200
14. Roesch, M.: Snort: Lightweight intrusion detection for networks. In: Proceedings of the 1999 USENIX LISA Systems Adminstration Conference. (1999)
15. N.Shalaby, L.Peterson, A.Bavier, Y.Gottlieb, S.Karlin, A.Nakao, X.Qie, T.Spalink, M.Wawrzoniak: Extensible routers for active networks. In: DANCE'02. (2002)
16. I.Charitakis, D.Pnevmatikatos, E.Markatos, K.Anagnostakis: S2I: a tool for automatic rule match compilation for the IXP network processor. In: SCOPES 2003, Vienna, Austria (2003) 226-239
17. Mogul, J.: TCP offload is a bad idea whose time has come. In: Proc. of HotOS IX, Lihue. Hawaii, USA (2003)
18. Tuck, N., Sherwood, T., Calder, B., Varghese, G..: Deterministic memory-efficient string matching algorithms for intrusion detection. In: Proceedings of IEEE Infocorn, Hong Kong, China (2004)
19. Malan, R., Watson, D., Jahanian, F., Howell, P.: Transport and application protocol scrubbing. In: Infocom'2000, Tel-Aviv, Israel (2000)
20. Handley, M., Paxson, V., Kreibich, C.: Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics. In: USENIX-Sec'2001, Washington, D.C., USA (2001)
21. Johnson, E.J., Kunze, A.R.: IXP1200 Programming. Intel Press (2002)
22. Debar, H., Dacier, M., Wepsi, A.: A revised taxonomy for intrusion-detection systems. Technical report, IBM Research, Zurich (1999)
23. Smaha, S.E.: Haystack: An intrusion detection system. In: IEEE Fourth Aerospace Computer Security Applications Conference, Orlando, FL, USA (1988)
24. Cheung, S., Crawford, R., Dilger, M., Frank, J., Hoagland, J., Levitt, K., Rowe J., Staniford, S., Yip, R., Zerkle, D.: The design of GrIDS: A graph-based intrusion detection system. Technical Report CSE-99-2, UC Davis (1999)
25. Cisco: Cisco secure intrusion detection system version 2.2.0 (netranger) (2002)
26. Farmer, D., Venema, W.: Improving the security of your site by breaking into it. Technical report, Internet White Paper (1993) http://www.fish.com/ security/.
27. Moore, D., Shannon, C., Voelker, G., Savage, S.: Internet quarantine: Requirements for containing self-propagating code, In: Infocom, San Francisco, CA (2003)
28. Ptacek, T.H., Newsham, T.N.: Insertion, evasion, and denial of service: Eluding network intrusion detection. Technical report, Secure Networks Inc. (1998)
29. Lee, W., Cabrera, J.B.D., Thomas, A., Balwalli, N., Saluja, S., Zhang, Y.: Performance adaptation in real-time intrusion detection systems. In: RAID'02, Zurich, Switzerland (2002)
30. Kerschbaum, F., Spafford, E.H., Zamboni, D.: Using embedded sensors for detecting network attack. Technical report, Purdue University (2000)