Memory Efficient String Matching Algorithm for Network Intrusion Management System

Tsinghua Science and Technology

Volumn 12, Issue 5, 2007, Pages 585-593

  Yu, Jianming ^a   Xue, Yibo ^a   Li, Jun ^a  

^a TSINGHUA UNIVERSITY   (China)

Author keywords

Aho Corasick (AC) algorithm; network intrusion management system (NIMS); string matching

Indexed keywords

ALGORITHMS; COMPUTER NETWORKS; DATA REDUCTION; MANAGEMENT INFORMATION SYSTEMS; PROGRAM PROCESSORS;

AHO-CORASICK ALGORITHM; NETWORK INTRUSION MANAGEMENT SYSTEM (NIMS); STRING MATCHING;

SECURITY OF DATA;

EID: 34748816267     PISSN: 10070214     EISSN: None     Source Type: Journal    
DOI: 10.1016/S1007-0214(07)70137-2     Document Type: Article

References (25)

1. th System Administration Conference and Exhibition (LISA'1999). Berkeley, CA, USA: USENIX Assoc., 1999: 229-238.
2. Norton M., and Roelker D. The new Snort. Computer Security Journal 19 3 (2003) 37-47
3. Antonatos S., Anagnostakis K., and Markatos E. Generating realistic workloads for network intrusion detection systems. Software Engineering Notes 29 1 (2004) 207-215
4. Aho A., and Corasick M. Fast pattern matching: An aid to bibliographic search. Communications of the ACM 18 6 (1975) 333-340
5. Fisk M., and Varghese G. An analysis of fast string matching applied to content-based forwarding and intrusion detection. Technical Report CS2001-0670 (2002), University of California, San Diego
6. Coit C J, Staniford S, McAlerney J. Towards faster string matching for intrusion detection or exceeding the speed of Snort. In: Proceedings of the DARPA Information Survivability Conference and Exposition II (DISCEX'01). Los Alamitos, CA, USA: IEEE Comput. Soc., 2001, 1: 367-373.
7. Norton M. Optimizing pattern matching for intrusion detection (2004). http://www.NIDSresearch.org
8. th IFIP International Information Security Conference (SEC2003). Athens, Greece: Kluwer Acadamic Pubhishers, 2003: 217-228.
9. Huang J, Tian J, Du R, Zhai J. Research of pattern matching in intrusion detection. In: Proceedings of the 2003 International Conference on Machine Learning and Cybernetics. Piscataway, NJ, USA: IEEE, 2003, 3: 1877-1882.
10. Liu R., Huang N., Chen C., and Kao C. A fast string-matching algorithm for network processor-based intrusion detection system. ACM Transactions on Embedded Computing Systems 3 3 (2004) 614-633
11. Jiang W., Song H., and Dai Y. Real-time intrusion detection for high speed networks. Computers and Security 24 4 (2005) 287-294
12. Yu J., and Li J. A parallel NIDS pattern matching engine and its implementation on network processor. Proceedings of the 2005 International Conference on Security and Management (2005), CSREA Press, Las Vegas, USA 375-381
13. Yusuf S., and Luk W. Bitwise optimized CAM for network intrusion detection systems. Proceedings of the 2005 International Conference on Field Programmable Logic and Applications (2005), IEEE, Tampere, Finland 444-449
14. Baker Z., and Prasanna V. A computationally efficient engine for flexible intrusion detection. IEEE Transactions on Very Large Scale Integration (VLSI) Systems 13 10 (2005) 1179-1189
15. th Annual IEEE Symposium on Field-Programmable Custom Computing Machines (2005), IEEE, Napa, CA, USA 225-234
16. th Annual IEEE Symposium on Field-Programmable Custom Computing Machine (2005), IEEE, Napa, CA, USA 235-242
17. nd Norchip Conference (2004), IEEE, Osio, Norway 214-217
18. th Symposium on High Performance Interconnects (2003), IEEE, Stanford, CA, USA 44-51
19. th ACM International Symposium on Field-Programmable Gate Arrays (2004), ACM, Monterey, CA, USA 223-232
20. Tuck N., Sherwood T., Calder B., and Varghese G. Deterministic memory-efficient string matching algorithms for intrusion detection. Proceedings of IEEE INFOCOM 2004 4 (2004), IEEE, Piscataway, NJ, USA 2628-2639
21. Boyer R., and Moore J. A fast string searching algorithm. Communications of the ACM 20 10 (1977) 762-772
22. Horspool R. Practical fast searching in strings. Software Practice and Experience 10 6 (1980) 501-506
23. Wu S., and Manber U. A fast algorithm for multi-pattern searching. Technical Report TR-94-17 (1994), University of Arizona
24. 2xB algorithm patch for Snort version 2.4.2 (2005). http://dcs.ics.forth.gr/Activities/Projects/snort.html
25. Cowan C, Arnold S, Beattie S, Wright C, Viega J DEFCON capture the flag: Defending vulnerable code form intense attack. In: Proceedings of the DARPA DISCEX III Conference. Washington D C, USA, 2003.