Counting bloom filters for pattern matching and anti-evasion at the wire speed

IEEE Network

Volumn 23, Issue 1, 2009, Pages 30-35

  Antichi, Gianni ^a   Ficara, Domenico ^a   Giordano, Stefano ^a   Procissi, Gregorio ^a   Vitucci, Fabio ^a  

^a UNIVERSITY OF PISA   (Italy)

Author keywords

Engines; Finite impulse response filter; Layout; Matched filters; Memory management; Pattern matching; Radiation detectors

Indexed keywords

BLOOM FILTERS; DATA PATHS; DEEP PACKET INSPECTIONS; EFFICIENT SYSTEMS; FINITE IMPULSE RESPONSE FILTER; HIGH-SPEED; INTRUSION DETECTION SYSTEMS; LAYOUT; MATCHED FILTERS; MATCHING ALGORITHMS; MEMORY MANAGEMENT; REASSEMBLY; STANDARD PATTERNS; TRAFFIC PROCESSING;

ACOUSTIC SIGNAL PROCESSING; BLOOMS (METAL); COMPUTER CRIME; FIR FILTERS; IMPULSE RESPONSE; INTERNET; NETWORK SECURITY; PATTERN MATCHING; RADIATION DAMAGE; RADIATION DETECTORS;

INTRUSION DETECTION;

EID: 65249112685     PISSN: 08908044     EISSN: None     Source Type: Journal    
DOI: 10.1109/MNET.2009.4804321     Document Type: Article

References (12)

1. S. Dharmapurikar et al., "Deep Packet Inspection Using Parallel Bloom Filters," IEEE Micro, vol. 24, no. 1, 2004, pp. 52-61.
2. M. Nourani and P. Katta, "Bloom Filter Accelerator for String Matching," Proc. 16th Int'l. Conf. Comp. Commun. Net., pp. 185-90.
3. L. Fan et al., "Summary Cache: A Scalable Wide-Area Web Cache Sharing Protocol," SIGCOMM Comp. Commun. Rev., vol. 28, no. 4, 1998, pp. 254-65.
4. T. H. Ptacek and T. N. Newsham, "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection," Secure Networks, Inc., T2R-0Y6, Tech. Rep., Alberta, Canada, 1998; http:// citeseer.ist.psu.edu/ptacek98insertion.html
5. M. Handley, V. Paxson, and C. Kreibich, "Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics," Proc. 10th Conf. USENIX Sec. Symp., 2001, p. 9.
6. N. S. Artan and H. J. Chao, "Multi-Packet Signature Detection Using Prefix Bloom Filters," Proc. IEEE GLOBECOM, vol. 3, 2005, pp. 1811-16.
7. G. Varghese, J. A. Fingerhut, and F. Bonomi, "Detecting Evasion Attacks at High Speeds without Reassembly," SIGCOMM Comp. Commun. Rev., vol. 36, no. 4, 2006, pp. 327-38.
8. M. Vutukuru, H. Balakrishnan, and V. Paxson, "Efficient and Robust TCP Stream Normalization," IEEE Symp. Sec. Privacy, Oakland, CA, May 2008.
9. D. Ficara et al., "Multilayer Compressed Counting Bloom Filters," Proc. INFOCOM '08, Apr. 2008.
10. H. Song et al., "Fast Hash Table Lookup Using Extended Bloom Filter: An Aid to Network Processing," Proc. 2005 Conf. Apps., Tech., Architectures, Protocols Comp. Commun., New York, NY, 2005, pp. 181-92.
11. D. Ficara et al., "Blooming Trees: Space-Efficient Structures for Data Representation," Proc. IEEE ICC '08, May 2008.
12. F. Bonomi et al., "An Improved Construction for Counting Bloom Filters," LNCS 4168, 14th Annual Euro.Symp. Algorithms, 2006, pp. 684-95.