A memory-efficient parallel string matching architecture for high-speed intrusion detection

IEEE Journal on Selected Areas in Communications

Volumn 24, Issue 10, 2006, Pages 1793-1803

  Lu, Hongbin ^a,b   Zheng, Kai ^a,b   Liu, Bin ^a,b   Zhang, Xin ^b   Liu, Yunhao ^a,c  

^a IEEE   (China)

^b TSINGHUA UNIVERSITY   (China)

^c HONG KONG UNIVERSITY OF SCIENCE AND TECHNOLOGY   (Hong Kong)

Author keywords

Computer network security; Finite automata; Parallel processing; Site security monitoring; String matching

Indexed keywords

COMPUTER NETWORK SECURITY; SITE SECURITY MONITORING; STRING MATCHING;

COMPUTATIONAL COMPLEXITY; ELECTRONIC DOCUMENT IDENTIFICATION SYSTEMS; FINITE AUTOMATA; INTERNET; PACKET NETWORKS; PARALLEL PROCESSING SYSTEMS; PATTERN MATCHING; SECURITY SYSTEMS;

COMPUTER ARCHITECTURE;

EID: 33749834749     PISSN: 07338716     EISSN: None     Source Type: Journal    
DOI: 10.1109/JSAC.2006.877221     Document Type: Article

References (35)

1. Snort-the de Facto Standard for Intrusion Detection/Prevention, [On-line]. Available: www.snort.org
2. S. Antonatos, K. G. Anagnostakis, and E. P. Markatos, "Generating realistic workloads for network intrusion detection systems," presented at the Proc. ACM Workshop on Software and Performance, Redwood Shores, CA, 2004.
3. S. Iyer, A. Awadallah, and N. McKeown, "Analysis of a packet switch with memories running slower than the line rate," in Proc. IEEE INFOCOM, Mar. 2000, pp. 529-537.
4. Embedded Memoiy, [Online]. Available: http://www.ti.com/research/docs/ cmosmemory.shtml
5. G. Navarro and M. Raffinot, Flexible Pattern Matching in Strings-Practical On-line Search Algorithms for Texts and Biological Sequences. Cambridge, U.K.: Cambridge Univ. Press, 2002.
6. C. J. Coit, S. Staniford, and J. McAlerney, "Towards faster string matching for intrusion detection or exceeding the speed of snort," in Proc. DARPA Information Survivability Conf. Exposition (DISCEX II'01), 2001, pp. 367-373.
7. M. Fisk and G. Varghese, "Fast content-based packet handling for intrusion detection," UCSD, UCSD Tech. Rep. CS2001-0670, 2001.
8. K. G. Anagnostakis, E. P. Markatos, S. Antonatos, and M. Polychronakis, "E2 XB: A domain-specific string matching algorithm for intrusion detection," presented at the 18th IFIP Int. Information Security Conf., Athens, Greece, 2003.
9. R. T. Liu, N. F. Huang, C. H. Chen, and C. N. Kao, "A fast string-match algorithm for network processor-based network intrusion detection system," ACM Trans. Embedded Comput. Syst., vol. 3, pp. 614-633, 2004.
10. J. Moscola, J. Lockwood, R. P. Loui, and M. Pachos, "Implementation of a content-scanning module for an Internet firewall," in Proc. 11th Annu. IEEE Symp. Field-Programmable Custom Comput. Mach., Napa, CA, Apr. 2003, pp. 31-38.
11. I. Sourdis and D. Pnevmatikatos, "Fast, large-scale string match for a 10 Gbps FPGA-based network intrusion detection system," presented at the 13th Conf. Field Programmable Logic and Appl., Lisbon, Portugal, 2003.
12. C. R. Clark and D. E. Schimmel, "Scalable pattern matching for high speed networks," in Proc. IEEE Symp. Field-Programmable Custom Comput. Mach., 2004, pp. 249-257.
13. Z. K. Baker and V. K. Prasanna, "A methodology for synthesis of efficient intrusion detection systems on FPGAs," in Proc. Field-Programmable Custom Comput. Mach. 12th Annu. IEEE Symp., 2004, pp. 135-144.
14. Y. Sugawara, M. Inaba, and K. Hiraki, "Over 10 Gbps string matching mechanism for multi-stream packet scanning systems," in Lecture Notes in Computer Science. Heidelberg, Germany: Springer-Verlag, 2004, vol. 3203, Proc. 14th In. Conf. Field-Programmable Logic Appl., pp. 484-493.
15. S. Yusuf and W. Luk, "Bitwise optimised CAM for network intrusion detection systems," in Proc. 15th Conf. Field Pmgrammable Logic Appl., 2005, pp. 444-449.
16. Y. H. Cho and W. H. Mangione-Smith, "Fast reconfiguring deep packet filter for 1+ gigabit network," in Proc. IEEE Symp. Field Programmable Custom Comput. Mach., Napa Valley, CA, 2005, pp. 215-224.
17. M. E. Attig and J. Lockwood, "A framework for rule processing in reconfigurable network systems," in Proc. 13th Annu. IEEE Symp. Field.-Programmable Custom Comput. Mach., Napa, CA, 2005, pp. 225-234.
18. F. Yu, R. H. Katz, and T. V. Lakshman, "Gigabit rate packet pattern-matching using TCAM," in Proc. Netw. Protocols, 12th IEEE Int. Conf., 2004, pp. 174-183.
19. A. V. Aho and M. J. Corasick, "Efficient string matching: An aid to bibliographic search," Commun. ACM, vol. 18, pp. 333-340, 1975.
20. N. Tuck, T. Sherwood, B. Calder, and G. Varghese, "Deterministic memory-efficient string matching algorithms for intrusion detection," in Proc. INFOCOM 23rd Annu. Joint Conf. IEEE Comput. Commun. Soc., 2004, pp. 2628-2639.
21. M. Aldwairi, T. Conte, and P. Franzon, "Configurable string matching hardware for speeding up," SIGARCH, Comput. Archil, News, vol. 33, no. 1, pp. 99-107, 2005.
22. L. Tan and T. Sherwood, "A high throughput string matching architecture for intrusion detection and prevention," in Proc. Int. Symp. Comput. Arch., 2005, pp. 112-122.
23. Y. H. Cho and W. H. Mangione-Smith, "A pattern matching coprocessor for network security," presented at the 42nd Des. Autom. Conf., Anaheim, CA, 2005.
24. S. Dharmapurikar, P. Krishnamurthy, T. S. Sproull, and J. W. Lockwood, "Deep packet inspection using parallel bloom filters," IEEE Micro, vol. 24, no. 1, pp. 52-61, 2004.
25. S. Dharmapurikar and J. Lockwood, "Fast and scalable pattern matching for content filtering," presented at the Symp. Arch. Netw. Commun. Syst., Princeton, NJ, 2005.
26. G. Tripp, "A finite-state machine based string matching system for intrusion detection on high-speed networks," in Proc. EICAR Conf., 2005, pp. 26-40.
27. J. E. Hopcroft, R. Motwani, and J. D. Ullman, Introduction to Automata Theory, Languages, and Computation, 2nd ed. Reading, MA: Addison-Wesley, 2000.
28. K. Pagiamtzis and A. Sheikholeslami, "Content-addressable memory (CAM) circuits and architectures: A tutorial and survey," IEEE J. Solid-State Circuits, vol. 41, pp. 712-727, 2006.
29. H. Lu, K. Zheng, B. Liu, X. Zhang, and Y. Liu, "A memory-efficient parallel string matching architecture for high speed intrusion detection,"Tech. Rep., 2005. [Online], Available:http://s-router.cs. tsinghua.edu.cn/~luhongbin/publications/TR_string_matching.pdf
30. T. H. Cormen, C. E. Leiserson, R. L. Rivest, and C. Stein, Introduction to Algorithms (2nd Edition). Cambridge, MA: Mass. Inst. Technol., 2001.
31. N. McKeown, "The iSLIP scheduling algorithm for input-queued switches," IEEE/ACM Trans. Netw., vol. 7, no. 2, pp. 188-201, Apr. 1999.
32. H. J. Chao and J. S. Park, "Centralized contention resolution schemes for a large-capacity optical ATM switch," in Proc. IEEE ATM Workshop, Fairfax, VA, May 1998, pp. 11-16.
33. B. H. Bloom, "Space/time trade-offs in hash coding with allowable errors," Commun. ACM, vol. 13, pp. 422-426, 1970.
34. S. Dharmapurikar, P. Krishnamurthy, and D. E. Taylor, Longest Prefix Matching Using Bloom Filters. Karlsruhe, Germany: ACM Press, 2003, Proc. ACM SIGCOMM, pp. 201-212.
35. Analog Bits Inc., High Speed Ternary CAM Datasheet, 2004. [Online], Available: www.analogbits.com/pdf/High_Speed_T_CAM_Datasheet.pdf