XFA: Faster signature matching with extended automata

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2008, Pages 187-201

  Smith, Randy ^a   Estan, Cristian ^a   Jha, Somesh ^a  

^a UNIVERSITY OF WISCONSIN MADISON   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CHLORINE COMPOUNDS; COMPUTER CRIME; INFORMATION SERVICES; INTERNET; INTRUSION DETECTION; NANOSTRUCTURED MATERIALS; ROBOTS; SECURITY OF DATA; SENSORS; TRANSLATION (LANGUAGES);

FINITE STATE AUTOMATON; INFORMATION SECURITY; NETWORK INTRUSION DETECTION SYSTEMS; NIDS SIGNATURES; SECURITY AND PRIVACY; SIGNATURE MATCHING; SPACE COMPLEXITIES; SUCCINCT REPRESENTATION; SYSTEM CALLS; TEST SETS; TIME COMPLEXITIES;

FINITE AUTOMATA;

EID: 50249130270     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2008.14     Document Type: Conference Paper

References (33)

1. A. V. Aho and M. J. Corasick. Efficient string matching: An aid to bibliographic search. In Communications of the ACM, June 1975.
2. R. Alur. Timed automata. In Proceedings of the Int. Conf. on Computer Aided Verification, pages 8-22, 1999.
3. R. S. Boyer and J. S. Moore. A fast string searching algorithm. In Communications of the ACM, volume 20, October 1977.
4. D. Brumley, J. Newsome, D. Song, H. Wang, and S. Jha. Towards automatic generation of vulnerability-based signatures. In IEEE Symposium on Security and Privacy, Oakland, California, May 2006.
5. C. R. Clark and D. E. Schimmel. Scalable pattern matching for high-speed networks. In IEEE Symposium on Field-Programmable Custom Computing Machines (FCCM), pages 249-257, April 2004.
6. C. J. Coit, S. Staniford, and J. McAlerney. Towards faster patternmatching for intrusion detection or exceeding the speed of Snort. In 2nd DARPA Information Survivability Conference and Exposition, June 2001.
7. S. Crosby. Denial of service through regular expressions. In Usenix Security work in progress report, August 2003.
8. S. T. Eckmann, G. Vigna, and R. A. Kemmerer. STATL: An attack language for state-based intrusion detection. Journal of Computer Security, 10(1/2):71-104, 2002.
9. M. Fisk and G. Varghese. Fast content-based packet handling for intrusion detection. TR CS2001-0670, UC San Diego, May 2001.
10. L. Fortnow. Nondeterministic polynomial time versus nondeterministic logarthmic space: Time-space tradeoffs for satisfiability. In Proceedings of Twelfth IEEE Conference on Computational Complexity, 1997.
11. M. Handley, V. Paxson, and C. Kreibich. Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics. In Usenix Security, August 2001.
12. T. A. Henzinger. The theory of hybrid automata. In Proceedings of the 11th Annual Symposium on Logic in Computer Science (LICS), pages 278-292, 1996.
13. M. Jordan. Dealing with metamorphism. Virus Bulletin Weekly, 2002.
14. S. Kumar, S. Dharmapurikar, F. Yu, P. Crowley, and J. Turner. Algorithms to accelerate multiple regular expressions matching for deep packet inspection. In Proceedings of ACM SIGCOMM, September 2006.
15. R-T Liu, N-F Huang, C-H Chen, and C-N Kao. A fast string-matching algorithm for network processor-based intrusion detection system. Transactions on Embedded Computing Sys., 3(3):614-633, 2004.
16. A. Narayanan and V. Shmatikov. Fast dictionary attacks on passwords using time-space tradeoff. In ACM Conference on Computer and Communications Security (CCS), 2005.
17. P. Oechslin. Making a faster cryptanalytic time-memory trade-off. In 23rd Annual International Cryptology Conference (CRYPTO), 2003.
18. V. Paxson. Bro: a system for detecting network intruders in real-time. In Computer Networks, volume 31, pages 2435-2463, 1999.
19. T. Ptacek and T. Newsham. Insertion, evasion and denial of service: Eluding network intrusion detection. In Secure Networks, Inc., January 1998.
20. M. Roesch. Snort - lightweight intrusion detection for networks. In Proceedings of the 13th Systems Administration Conference. USENIX, 1999.
21. S. Rubin, S. Jha, and B. Miller. Language-based generation and evaluation of NIDS signatures. In IEEE Symposium on Security and Privacy, May 2005.
22. S. Rubin, S. Jha, and B. P. Miller. Protomatching network traffic for high throughput network intrusion detection. In ACM Conference on Computer and Communications Security (CCS), pages 47-58, 2006.
23. R. Sekar and P. Uppuluri. Synthesizing fast intrusion prevention/detection systems from high-level specifications. In Usenix Security, August 1999.
24. U. Shankar and V. Paxson. Active mapping: Resisting NIDS evasion without altering traffic. In IEEE Symposium on Security and Privacy, May 2003.
25. R. Sidhu and V. Prasanna. Fast regular expression matching using FPGAs. In Field-Programmable Custom Computing Machines (FCCM), April 2001.
26. R. Sommer and V. Paxson. Enhancing byte-level network intrusion detection signatures with context. In ACMConference on Computer and Communications Security (CCS), 2003.
27. I. Sourdis and D. Pnevmatikatos. Fast, large-scale string match for a 10gbps fpga-based network intrusion detection system. In International Conference on Field Programmable Logic and Applications, September 2003.
28. I. Sourdis and D. Pnevmatikatos. Pre-decoded CAMs for efficient and high-speed NIDS pattern matching. In IEEE Symposium on Field-Programmable Custom Computing Machines (FCCM), April 2004.
29. L. Tan and T. Sherwood. A high throughput string matching architecture for intrusion detection and prevention. In International Symposium on Computer Architecture (ISCA), June 2005.
30. K. Thompson. Programming techniques: Regular expression search algorithm. Commun. ACM, 11(6):419-422, 1968.
31. H. J. Wang, C. Guo, D. Simon, and A. Zugenmaier. Shield: Vulnerability-driven network filters for preventing known vulnerability exploits. In Proceedings of the 2004 ACM SIGCOMM Conference, August 2004.
32. V. Yegneswaran, J. T. Giffin, P. Barford, and S. Jha. An architecture for generating semantics-aware signatures. In 14th USENIX Security Symposium, August 2005.
33. F. Yu, Z. Chen, Y. Diao, T. V. Lakshman, and R. H. Katz. Fast and memory-efficient regular expression matching for deep packet inspection. In Proceedings of Architectures for Networking and Communications Systems (ANCS), pages 93-102, 2006.