Approximate fingerprinting to accelerate pattern matching

Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

Volumn , Issue , 2006, Pages 301-306

  Ramaswamy, Ramaswamy ^a   Kencl, Lukas ^b   Iannaccone, Gianluca ^b  

^a UNIVERSITY OF MASSACHUSETTS   (United States)

^b INTEL CORPORATION   (United States)

Author keywords

Deep packet inspection; Fingerprint; Intrusion detection; Pattern matching

Indexed keywords

DEEP PACKET INSPECTION; NETWORK MONITORING SYSTEMS; SMALL MEMORY FOOTPRINTS; WORM DETECTING ALGORITHMS;

ALGORITHMS; NETWORK SECURITY; PACKET NETWORKS; PATTERN MATCHING; STORAGE ALLOCATION (COMPUTER);

INTRUSION DETECTION;

EID: 34547414157     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1177080.1177120     Document Type: Conference Paper

References (21)

1. A. V. Aho and M. J. Corasick. Efficient string matching: an aid to bibliographic search. Communications of the ACM, 18(6):333-340, June 1975.
2. 2xB: A domain-specific string matching algorithm for intrusion detection. In Proceedings of IFIP Information Security Conference, May 2003.
3. H. Bos and K. Huang. Towards software-based signature detection for intrusion prevention on the network card. In Proceedings of Symposium on Recent Advances in Intrusion Detection, Sept. 2005.
4. B. Commentz-Walter. A string matching algorithm fast on the average. In Proceedings of ICALP, pages 118-132, July 1979.
5. S. Dharmapurikar, P. Krishnamurthy, T. Sproull, and J. Lockwood. Deep packet inspection using parallel bloom filters. In Proceedings of Symposium on High Performance Interconnects (HotI), pages 44-51, Aug. 2003.
6. S. Dharmapurikar and J. Lockwood. Fast and scalable pattern matching for content filtering. In Proceedings of ANCS, Oct. 2005.
7. H.-A. Kim and B. Karp. Autograph: Toward automated, distributed worm signature detection. In Proceedings of Usenix Security, Aug. 2004.
8. U. Manber. Finding similar files in a large file system. In Proceedings of Usenix Conference, 1994.
9. A. Moore, J. Hall, E. Harris, C. Kreibech, and I. Pratt. Architecture of a network monitor. In Proceedings of Passive and Active Measurement Workshop, Apr. 2003.
10. J. Newsome, B. Karp, and D. Song. Polygraph: Automatically generating signatures for polymorphic worms. In Proceedings of the IEEE Symposium on Security and Privacy, May 2005.
11. V. Paxson. Bro: A system for detecting network intruders in real-time. Computer Networks, 31, 1999.
12. M. Rabin. Fingerprinting by random polynomials. Technical Report TR-15-81, Harvard University, Department of Computer Science, 1981.
13. M. Roesch. Snort: Lightweigth intrusion detection. In Proceedings of Usenix LISA, Nov. 1999.
14. S. Singh, C. Estan, G. Varghese, and S. Savage. Automated worm fingerprinting. In OSDI, Dec. 2004.
15. R. Sommer and V. Paxson. Enhancing byte-level network intrusion detection signatures with context. In Proceedings of the 10th ACM Conference on Computer and Communications Security, 2003.
16. H. Song, T. Sproull, M. Attig, and J. Lockwood. Snort offloader: A reconfigurable hardware NIDS filter. In Proceedings of 15th International Conference on Field Programmable Logic and Applications (FPL), Tampere, Finland, Aug. 2005.
17. N. Spring and D. Wetherall. A protocol-independent technique for eliminating redundant network traffic. In Proceedings of ACM SIGCOMM, 2000.
18. Y. Sugawara, M. Inaba, and K. Hiraki. Over 10 Gbps string matching mechanisms for multi-stream packet scanning systems. In Proceedings of Field Programmable Logic and Application, Apr. 2004.
19. L. Tan and T. Sherwood. A high throughput string matching architecture for intrusion detection and prevention. In Proceedings of the International Symposium on Computer Architecture, June 2005.
20. N. Tuck, T. Sherwood, B. Calder, and G. Varghese. Deterministic memory-efficient string matching algorithms for intrusion detection. In Proceedings of IEEE Infocom, Mar. 2004.
21. S. Wu and U. Manber. Agrep - a fast approximate pattern-matching tool. In Proceedings of Usenix Conference, pages 153-162, 1992.