Fast and scalable pattern matching for network intrusion detection systems

IEEE Journal on Selected Areas in Communications

Volumn 24, Issue 10, 2006, Pages 1781-1791

  Dharmapurikar, Sarang ^b   Lockwood, John W ^a,b  

^a IEEE

^b WASHINGTON UNIVERSITY IN ST LOUIS   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BLOOM FILTERS; EMBEDDED MEMORY; MULTIPATTERN MATCHING;

ALGORITHMS; COMPUTER HARDWARE; DATA STRUCTURES; EMBEDDED SYSTEMS; FIELD PROGRAMMABLE GATE ARRAYS; PACKET NETWORKS; SECURITY SYSTEMS;

PATTERN MATCHING;

EID: 33749822913     PISSN: 07338716     EISSN: None     Source Type: Journal    
DOI: 10.1109/JSAC.2006.877131     Document Type: Article

References (16)

1. Snort. [Online], Available: http://www.snort.org
2. A. V. Aho and M. J. Corasick, "Efficient string matching: An aid to bibliographic search," Commun. ACM, vol. 18, no. 6, pp. 333-340, 1975.
3. Z. K. Baker and V. K. Prasanna, "Time and area efficient pattern matching on FPGAs," in Proc. 2004 ACM/SIGDA 12th Int. Symp. Field Programmable Gate Arrays, 2004, pp. 223-232.
4. B. Bloom, "Space/time trade-offs in hash coding with allowable errors," ACM, vol. 13, no. 7, pp. 422-426, May 1970.
5. Y. Cho and W. Mangione Smith, "Fast reconfiguring deep packet filter for 1+ Gigabit network," in Proc. IEEE Symp. Field-Programmable Custom Comput. Mach., Napa, CA, Apr. 2005, pp. 215-224.
6. C. R. Clark and D. E. Schimmel, "Scalable multi-pattern matching on high-speed networks," in Proc. IEEE Symp. Field-Programmable Custom Comput. Mach., Napa, CA, Apr. 2004.
7. D. L. Stephen, "String searching algorithms," Lectures Notes Series on Computing, vol. 3, 1994.
8. S. Dharmapurikar, P. Krishnamurthy, T. Sproull, and J. W. Lockwood, "Deep packet inspection using parallel Bloom filters," in Proc. IEEE Symp. High Performance Interconnects (Hotl), Stanford, CA, Aug. 2003. pp. 44-51.
9. S. Dharmapurikar, P. Krishnamurthy, and D. E. Taylor, "Longest prefix matching using Bloom filters," in Proc. ACM SIGCOMM, Aug. 2003.
10. H. Song, S. Dharmapurikar, J. Turner, and J. W. Lockwood, "Fast hash table lookup using extended bloom filters: An aid to network processing," in Proc. ACM SIGCOMM, Philadelphia, PA, Aug. 2005.
11. L. Fan, P. Cao, J. Almeida, and A. Z. Broder, "Summary cache: A scalable wide-area web cache sharing protocol," IEEE/ACM Trans. Netw., vol. 8, no. 3, pp. 281-293, Jun. 2000.
12. I. Sourdis and D. Pnevmatikatos, "Pre-decoded CAMs for efficient and high-speed NIDS pattern matching," in Proc. IEEE Symp. Field-Programmable Custom Comput. Mach., Napa, CA, Apr. 2004, pp. 258-267.
13. M. Attig, S. Dharmapurikar, and J. Lockwood, "Implementation results of Bloom filters for string matching," in Proc. IEEE Symp. Field-Programmable Custom Comput. Mach., Napa, CA, Apr. 2004, pp. 322-323.
14. Y. Sugawara, M. Inaba, and K. Hiraki, "Over 10 Gbps string matching mechanism for multi-stream packet scanning systems," in Proc. 14th Int. Conf. Field Programmable Logic Appl., Antwerp, Belgium, Aug. 2004.
15. N. Tuck, T. Sherwood, B. Calder, and G. Varghese, "Deterministic memory-efficient string matching algorithms for intrusion detection," in Proc. IEEE INFOCOM, Hong Kong, China, Mar. 2004, pp. 2628-2639.
16. F. Yu, R. Katz, and T. V. Lakshman, "Gigabit rate packet pattern-matching using TCAM," in Proc. IEEE Int. Conf. Netw. Protocols, Berlin, Germany, Oct. 2004, pp. 174-183.