High speed pattern matching for network IDS/IPS

Proceedings - International Conference on Network Protocols, ICNP

Volumn , Issue , 2006, Pages 187-196

  Alicherry, Mansoor ^a   Muthuprasanna, M ^b   Kumar, Vijay ^a  

^a LUCENT TECHNOLOGIES   (United States)

^b IOWA STATE UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BOOLEAN FUNCTIONS; INTERNET; INTERNET PROTOCOLS; NETWORK ARCHITECTURE; PATTERN MATCHING; SPEED;

(E ,3E) PROCESS; (PL) PROPERTIES; AHO-CORASICK ALGORITHMS; COMPUTING INFRASTRUCTURES; CRITICAL COMPONENTS; EFFICIENT IMPLEMENTATION; GIGABITS PER SECOND; HIGH SPEEDS; INTERNATIONAL CONFERENCES; MEMORY REQUIREMENTS; MEMORY SPEEDS; NETWORK SPEED; SEARCH SPEEDS; SECURITY ATTACKS; SIGNATURE DATABASES; SIMULATION RESULTS; STRING MATCHING; STRING MATCHING ALGORITHMS;

NETWORK PROTOCOLS;

EID: 46149109486     PISSN: 10921648     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICNP.2006.320212     Document Type: Conference Paper

References (35)

1. http://www.wildlist.org. The Wildlist Organization Intl., April 2005.
2. R. Lemos, http://www.alertsite.com/articles-cnet-feb-2004.shtml. Performance Testing and Monitoring, Feb 2004.
3. D. M. et. al., "Internet quarantine: Requirements for containing self-propagating code," in INFOCOM, 2003.
4. L. Feinstein, D. Schnackenberg, R. Balupari, and D. Kindred, "Statistical approaches to ddos attack detection and response," in DISCEX, 2003.
5. L. Spitzner, Honeypots: Tracking Attackers. Addison-Wesley, 2002.
6. C. Morrow, http://www.secsup.org/Tracking. BlackHole Route Server and Tracking Traffic on an IP Network.
7. http://www.snort.org. SNORT: Open-Source Network IDS/IPS.
8. A. V. Aho and M. J. Corasick, "Efficient string matching: an aid to bibliographic search," Commun. ACM, vol. 18, no. 6, pp. 333-340, 1975.
9. D. E. Knuth, J. H. M. Jr., and V. R. Pratt, "Fast pattern matching in strings," SIAM J. Comput., vol. 6, no. 2, pp. 323-350, June 1977.
10. R. S. Boyer and J. S. Moore, "A fast string matching algorithm," Commun. ACM, vol. 20, no. 10, pp. 762-772, October 1977.
11. D. M. Sunday, "A very fast substring search algorithm," Commun. ACM, vol. 33, no. 8, pp. 132-142, August 1990.
12. M. Crochemore and D. Perrin, "Two-way string matching," J. ACM, vol. 38, no. 3, pp. 650-674, 1991.
13. R. M. Karp and M. O. Rabin, "Efficient randomized pattern-matching algorithms," IBM J. Res. Dev., vol. 31, no. 2, pp. 249-260, 1987.
14. Z. Galil and J. Seiferas, "Time-space optimal string matching (preliminary report)" in STOC, 1981.
15. N. T. et.al., "Deterministic memory-efficient string matching algorithms for intrusion detection," INFOCOM, 2004.
16. J. J. Fan and K. Y. Su, "An efficient algorithm for matching multiple patterns," IEEE Trans. on Knowledge and Data Engineering, vol. 5, no. 2, pp. 339-351, 1993.
17. B. Commentz-Walter, "A string matching algorithm fast on the average," in ICALP, 1979.
18. M. Fish and G. Verghese, "Fast content-based packet handling for intrusion detection," in UCSD Technical Report CS2001-0670, 2001.
19. U. Manber and S. Wu, "A fast algorithm for multi-pattern searching," in Tech.Report TR-94-17, CS Dept., University of Arizona, 1994.
20. Y. Sugawara, M. Inaba, and K. Hiraki, "Over 10gbps string matching mechanism for multi-stream packet scanning systems," in FPL, 2004.
21. G. Tripp, "A finite-state machine based string matching system for intrusion detection on high-speed networks," in EICAR, 2005.
22. M. Aldwairi, T. Conte, and P. Franzon, "Configurable string matching hardware for speeding up intrusion detection," SIGARCH. Comput. Archit. News, vol. 33, no. 1, pp. 99-107, 2005.
23. F. Yu, R. Katz, and T. V. Lakshman, "Gigabit rate packet pattern matching using team," in ICNP, 2004.
24. L. Tan and T. Sherwood, "A high throughput string matching architecture for intrusion detection and prevention," in ISCA, 2005.
25. J. V. Lunteran, "High-performance pattern-matching for intrusion detection," IEEE Infocom, 2006.
26. S. Dharmapurikar, P. Krishnamurthy, T. Sproull, and J. W. Lockwood, "Deep packet inspection using parallel bloom filters," in Micro, 2004.
27. R. Sidhu and V. K. Prasanna, "Fast regular expression matching using fpgas," in FCCM, 2001.
28. Z. K. Barker and V. K. Prasanna, "Time and area efficient pattern matching on fpgas," in FPGA, 2004.
29. C. R. Clark and D. E. Schimmel, "Efficient reconfigurable logic circuits for matching complex intrusion detection patterns," in FPL, 2003.
30. B. L. Hutchings, R. Franklin, and D. Carver, "Assisting network intrusion detection with reconfigurable hardware," in FCCM, 2002.
31. I. Sourdis and D. Pnevmatikatos, "Pre-decoded cams for efficient and high speed nids pattern matching," in FCCM, 2004.
32. M. Gokhale, D. Dubois, A. Dubois, M. Boorman, S. Poole, and V. Hogsett, "Towards gigabit rate network intrusion detection technology," in FPL, 2002.
33. Y. H. Cho, S. Navab, and W. H. Mangione-Smith, "Specialized hardware for deep network packet filtering," in FPL, 2002.
34. M. Alicherry, M. Muthuprasanna, V. Kumar, and V. Poosala, "Multicharacter multi-pattern matching for high speed applications," in Lucent Bell Labs Technical Report, 2005.
35. http://www.clamav.net. Clam AntiVirus toolkit for UNIX.