Deflating the big bang: Fast and scalable deep packet inspection with extended finite automata

Computer Communication Review

Volumn 38, Issue 4, 2008, Pages 207-218

  Smith, Randy ^a   Estan, Cristian ^a   Jha, Somesh ^a   Kong, Shijin ^a  

^a University of Wisconsin   (United States)

Author keywords

Deep packet inspection; Regular expressions; Signature matching; Xfa

Indexed keywords

AUXILIARY VARIABLES; BIG BANGS; CISCO SYSTEMS; COMPILER OPTIMIZATIONS; DEEP PACKET INSPECTION; FIRST-PRINCIPLES; FORMAL MODELS; FOUR ORDERS; HIGH-SPEED; NETWORK SERVICES; PER-FLOW STATE; REGULAR EXPRESSIONS; RUN-TIME; RUNTIMES; SIGNATURE MATCHING; SIGNATURE SETS; STATE-SPACE EXPLOSIONS; STATE-SPACE REDUCTIONS; XFA;

BINARY SEQUENCES; CONVOLUTIONAL CODES; FINITE AUTOMATA; INSPECTION; NANOSTRUCTURED MATERIALS; SECURITY OF DATA; SPEECH RECOGNITION; TRANSLATION (LANGUAGES);

PACKET NETWORKS;

EID: 65249094689     PISSN: 01464833     EISSN: 01464833     Source Type: Conference Proceeding    
DOI: 10.1145/1402946.1402983     Document Type: Conference Paper

References (37)

1. A. V. Aho and M. Corasick. Efficient string matching: An aid to bibliographic search. In Communications of the ACM, June 1975.
2. T. Ball and S. Rajamani. The SLAM project: Debugging system software via static analysis. January 2002.
3. M. Becchi and S. Cadambi. Memory-efficient regular expression search using state merging. In IEEE Infocom 2007.
4. M. Becchi and P. Crowley. An improved algorithm to accelerate regular expression evaluation. In ANCS 2007.
5. B. Brodie, R., and D. Taylor. A scalable architecture for high-throughput regular-expression pattern matching. SIGARCH Comput. Archit. News, 34(2):191-202, 2006.
6. D. Brumley, J. Newsome, D. Song, H. Wang, and S. Jha. Towards automatic generation of vulnerability-based signatures. In IEEE Symposium on Security and Privacy, May 2006.
7. C. R. Clark and D. E. Schimmel. Scalable pattern matching for high-speed networks. In IEEE FCCM, April 2004.
8. E. M. Clarke, O. Grumberg, and D. Peled. Model Checking. The MIT Press, 1999.
9. S. Crosby and D. Wallach. Denial of service via algorithmic complexity attacks. In Usenix Security, August 2003.
10. S. Dharmapurikar and J. W. Lockwood. Fast and scalable pattern matching for network intrusion detection systems. IEEE Journal on Selected Areas in Comm., 24(10):1781-1792, 2006.
11. The Guardian. Trouble on the line, http http://technology.guardian.co.uk/ weekly/story/0,1747343,00.html, 2006.
12. M. Handley, V. Paxson, and C. Kreibich. Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics. In Usenix Security, August 2001.
13. S. W. Hawking. A brief history of time. From the Big Bang to Black Holes. Bantam Book, 1988.
14. John L. Hennessy and David A. Patterson. Computer Architecture: A Quantitative Approach, 2nd Edition. Morgan Kaufmann, 1996.
15. J. Hopcroft, R. Motwani, and J. Ullman. Introduction to Automata Theory, Languages, and Computation. Addison Wesley, 2006.
16. Myles Jordan. Dealing with metamorphism. Virus Bulletin Weekly, 2002.
17. C. Kachris and S. Vassiliadis. Design of a web switch in a reconfigurable platform. In ANCS 2006.
18. P. Kapustka. Vonage complaining of VoIP blocking. http://www. networkcomputing.com/channels/networkinfrastructure/60400413, 2005.
19. S. Kumar, B. Chandrasekaran, J. Turner, and G. Varghese. Curing regular expressions matching algorithms from insomnia, amnesia, and acalculia. In ANCS 2007, pages 155-164.
20. S. Kumar, S. Dharmapurikar, F. Yu, P. Crowley, and J. Turner. Algorithms to accelerate multiple regular expressions matching for deep packet inspection. In ACM SIGCOMM, September 2006.
21. S. Kumar, J. Turner, and J. Williams. Advanced algorithms for fast and scalable deep packet inspection. In ANCS 2006, pages 81-92.
22. R. Liu, N. Huang, C. Chen, and C. Kao. A fast string-matching algorithm for network processor-based intrusion detection system. Trans. on Embedded Computing Sys., 3(3):614-633, 2004.
23. H. McGhan. Niagara 2 opens the floodgates. In Microprocessor Report, November 2006.
24. S. Muchnick. Advanced Compiler Design and Implementation. Morgan Kaufmann, 1997.
25. M. Neider. Deep packet inspection: A service provider's solution for secure VoIP. VoIP Magazine, Oct 2005.
26. V. Paxson. Bro: a system for detecting network intruders in real-time. In Computer Networks, volume 31, pages 2435-2463, 1999.
27. T. Ptacek and T. Newsham. Insertion, evasion and denial of service: Eluding network intrusion detection. In Secure Networks, Inc., January 1998.
28. M. Roesch. Snort - lightweight intrusion detection for networks. In 13th Systems Administration Conference. USENIX, 1999.
29. U. Shankar and Vern Paxson. Active mapping: Resisting nids evasion without altering traffic. In IEEE Symp. on Security and Privacy, May 2003.
30. R. Smith, C. Estan, and S. Jha. Backtracking algorithmic complexity attacks against a NIDS. In ACSAC 2006, pages 89-98.
31. R. Smith, C. Estan, and S. Jha. XFA: Faster signature matching with extended automata. In IEEE Symposium on Security and Privacy, May 2008.
32. R. Sommer and V. Paxson. Enhancing byte-level network intrusion detection signatures with context. In ACM CCS, Oct. 2003.
33. I. Sourdis and D. Pnevmatikatos. Fast, large-scale string match for a 10gbps fpga-based network intrusion detection system. In Int. Conf. on Field Programmable Logic and Applications, sep. 2003.
34. L. Tan and T. Sherwood. A high throughput string matching architecture for intrusion detection and prevention. In ISCA, June 2005.
35. N. Tuck, T. Sherwood, B. Calder, and G. Varghese. Deterministic memory-efficient string matching algorithms for intrusion detection. In IEEE INFOCOM 2004, pages 333-340.
36. H. J. Wang, C. Guo, D. Simon, and A. Zugenmaier. Shield: Vulnerability-driven network filters for preventing known vulnerability exploits. In ACM SIGCOMM, August 2004.
37. F. Yu, Z. Chen, Y. Diao, T. V. Lakshman, and R. H. Katz. Fast and memory-efficient regular expression matching for deep packet inspection. In ANCS 2006.