TriBiCa: Trie bitmap content analyzer for high-speed network intrusion detection

Proceedings - IEEE INFOCOM

Volumn , Issue , 2007, Pages 125-133

  Sertac Artan, N ^a   Jonathan Chao, H ^a  

^a POLYTECHNIC UNIVERSITY   (United States)

Author keywords

Minimal perfect hashing; NIDPS; TriBiCa

Indexed keywords

ELECTRIC POWER UTILIZATION; ELECTRONIC DOCUMENT IDENTIFICATION SYSTEMS; INTRUSION DETECTION; PACKET SWITCHING; PIPELINE PROCESSING SYSTEMS;

DEEP PACKET INSPECTION (DPI); MINIMAL PERFECT HASHING; NIDPS; TRIBICA;

TELECOMMUNICATION NETWORKS;

EID: 34548300090     PISSN: 0743166X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INFCOM.2007.23     Document Type: Conference Paper

References (25)

1. C. Burns and D. Newman. (2006, Jan.) Vendors choose to tout disparate application-acceleration techniques. [Online], Available: http://www. networkworld.com/reviews/2006/011606-wfe-features.html
2. S. Singh, C. Estan, G. Varghese, and S. Savage, "Automated worm fingerprinting," in Proc. of the ACM/USENIX Symposium on Operating System Design and Implementation, San Francisco, CA, Dec. 2004.
3. [Online]. Available: http://www.snort.org
4. F. Yu, T. Lakshman, and R. Katz, "Gigabit rate pattern-matching using team," in Int. Conf. on Network Protocols (ICNP), Berlin, Germany, Oct. 2004.
5. H. Song and J. Lockwood, "Multi-pattern signature matching for hardware network intrusion detection systems," in IEEE Globecom 2005, nov-dec 2005.
6. J. Moscola, J. Lockwood, R. P. Loui, and M. P., "Implementation of a content-scanning module for an internet firewall." in FCCM, 2003, pp. 31-38.
7. C. Clark and D. Schimmel, "Scalable pattern matching for high-speed networks," in IEEE Symposium on Field-Programmable Custom Computing Machines (FCCM), Napa, California, 2004, pp. 249-257.
8. Y. H. Cho and W. H. Mangione-Smith, "Fast reconfiguring deep packet filter for 1+ gigabit network." in FCCM, 2005, pp. 215-224.
9. Z. K. Baker and V. K. Prasanna, "High-throughput Linked-Pattern Matching for Intrusion Detection Systems," in Proceedings of the First Annual ACM Symposium on Architectures for Networking and Communications Systems, 2005.
10. N. Tuck, T. Sherwood, B. Calder, and G. Varghese, "Deterministic memory-efficient string matching algorithms for intrusion detection," in Proc. of the 2004 IEEE Infocom Conference, 2004.
11. I. Sourdis, D. Pnevmatikatos, S. Wong, and S. Vassiliadis, "A reconfigurable perfect-hashing scheme for packet inspection," in Proc. 15th International Conference on Field Programmable Logic and Applications (FPL 2005), August 2005, pp. 644-647.
12. Y. Lu, B. Prabhakar, and F. Bonomi, "Perfect hashing for network applications," in IEEE Symposium on Information Theory), Seattle, WA, 2006, pp. 2774-2778.
13. L. Tan and T. Sherwood, "Architectures for bit-split string scanning in intrusion detection," IEEE Micro, jan-feb 2006.
14. G. Papadopoulos and D. N. Pnevmatikatos, "Hashing + memory = low cost, exact pattern matching." in Proc. 15th International Conference on Field Programmable Logic and Applications (FPL), August 2005, pp. 39-44.
15. A. Aho and M. J. Corasick, "Efficient string matching: an aid to bibliographic search," Communications of the ACM, vol. 18, no. 6, pp. 333-340, 1975.
16. H.-J. Jung, Z. K. Baker, and V. K. Prasanna, "Performance of FPGA Implementation of Bit-split Architecture for Intrusion Detection Systems," in Proceedings of the Reconfigurable Architectures Workshop at IPDPS (RAW '06), 2006.
17. K. Anagnostakis, S. Antonatos, E. Markatos, and M. Polychronakis, "E2xb: A domain-specific string matching algorithm for intrusion detection," in Proc. of the 18th IFIP International Information Security Conference, 2003.
18. S.Dharmapurikar, P.Krishnamurthy, T. Sproull, and J. Lockwood, "Deep packet inspection using parallel bloom filters," in Symposium on High Performance Interconnects (HotI), Stanford, CA, Aug. 2003, pp. 44-51.
19. H. Song, T. Sproull, M. Attig, and J. Lockwood, "Snort offloader: A reconfigurable hardware nids filter," in 15th International Conference on Field Programmable Logic and Applications (FPL 2005), Tampere, Finland, Aug. 2005.
20. B. Bloom, "Space/time trade-offs in hash coding with allowable errors," Communications of the ACM, vol. 13, no. 7, 1970.
21. M. Garey and D. Johnson, Computers and Intractability: A Guide to NP-Completeness. San Francisco, CA: Freeman, 1979.
22. B. Hayes, "The easiest hard problem," American Scientist, vol. 90, no. mar-apr, pp. 113-117, 2002.
23. T. Cormen, C. Leiserson, and R. Rivest, Introduction to Algorithms. The MIT Press, 2001.
24. S. Dharmapurikar and J. Lockwood, "Fast and scalable pattern matching for content filtering," in Symposium on Architectures for Networking and Communications Systems (ANCS), Oct. 2005.
25. N. S. Artan and H. J. Chao, "Design and analysis of a multi-packet signature detection system," to appear in Int. J. Security and Networks.