Accelerating multi-patterns matching on compressed HTTP traffic

Proceedings - IEEE INFOCOM

Volumn , Issue , 2009, Pages 397-405

  Bremler Barr, Anat ^a   Koral, Yaron ^a  

^a INTERDISCIPLINARY CENTER   (Israel)

Author keywords

[No Author keywords available]

Indexed keywords

AHO-CORASICK; DECOMPRESSION PHASE; HTTP PROTOCOLS; HTTP TRAFFIC; MALICIOUS ACTIVITIES; MATCHING ALGORITHM; NOVEL ALGORITHM; ON-THE-FLY; PATTERN MATCHING ALGORITHMS; PERFORMANCE PENALTIES; SECURITY TOOLS; STRING MATCHING;

ALGORITHMS; HTTP; HYPERTEXT SYSTEMS; INTERNET; PATTERN MATCHING; TERNARY SYSTEMS;

NETWORK SECURITY;

EID: 70349661814     PISSN: 0743166X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INFCOM.2009.5061944     Document Type: Conference Paper

References (25)

1. M. Fisk and G. Varghese, "An analysis of fast string matching applied to content-based forwarding and intrusion detection," Techical Report CS2001-0670 (updated version), 2002.
2. P. Deutsch, "Gzip file format specification," May 1996. RFC 1952, http://www.ietf.org/rfc/rfc1952.txt.
3. "Website optimization, llc." http://www.websiteoptimization. com.
4. P. Deutsch, "Deflate compressed data format specification," May 1996. RFC 1951, http://www.ietf.org/rfc/rfc1951.txt.
5. J. Ziv and A. Lempel, "A universal algorithm for sequential data compression," IEEE Transactions on Information Theory, pp. 337-343, May 1977.
6. D. Huffman, "A method for the construction of minimum-redundancy codes," Proceedings of IRE, p. 10981101, 1952.
7. A. Aho and M. Corasick, "Efficient string matching: an aid to bibliographic search," Communications of the ACM, pp. 333-340, 1975.
8. R. Boyer and J. Moore, "A fast string searching algorithm," Communications of the ACM, pp. 762-772, October 1977.
9. "Snort." http://www.snort.org (accessed on July 2008).
10. N. Tuck, T. Sherwood, B. Calder, and G. Varghese, "Deterministic memoryefficient string matching algorithms for intrusion detection," in INFOCOM 2004, 2004.
11. T. Song, W. Zhang, D. Wang, and Y. Xue, "A memory efficient multiple pattern matching architecture for network security," in INFOCOM 2008, pp. 166-170, April 2008.
12. J. van Lunteren, "High-performance pattern-matching for intrusion detection," in INFOCOM 2006. 25th IEEE International Conference on Computer Communications, pp. 1-13, April 2006.
13. V. Dimopoulos, I. Papaefstathiou, and D. Pnevmatikatos, "A memory-efficient reconfigurable aho-corasick fsm implementation for intrusion detection systems," in Embedded Computer Systems: Architectures, Modeling and Simulation. IC-SAMOS, pp. 186-193, July 2007.
14. M. Alicherry, M. Muthuprasanna, and V. Kumar, "High speed pattern matching for network ids/ips," in ICNP, pp. 187-196, 2006.
15. A. Amir, G. Benson, and M. Farach, "Let sleeping files lie: Pattern matching in z-compressed files," Journal of Computer and System Sciences, pp. 299-307, 1996.
16. T. Kida, M. Takeda, A. Shinohara, and S. Arikawa, "Shift-and approach to pattern matching in lzw compressed text," in 10th Annual Symposium on Combinatorial Pattern Matching (CPM 99), 1999.
17. G. Navarro and M. Raffinot, "A general practical approach to pattern matching over ziv-lempel compressed text," in 10th Annual Symposium on Combinatorial Pattern Matching (CPM 99), 1999.
18. G. Navarro and J. Tarhio, "Boyer-moore string matching over ziv-lempel compressed text," in Proceedings of the 11th Annual Symposium on Combinatorial Pattern Matching, pp. 166-180, 2000.
19. S. Klein and D. Shapira, "A new compression method for compressed matching," in Proceedings of data compression conference DCC-2000, Snowbird, Utah, pp. 400-409, 2000.
20. M. Farach and M. Thorup, "String matching in lempel-ziv compressed strings," in 27th annual ACM symposium on the theory of computing, pp. 703-712, 1995.
21. U. Manber, "A text compression scheme that allows fast searching directly in the compressed file," ACM Transactions on Information Systems (TOIS), pp. 124-136, 1997.
22. M. Takeda, Y. Shibata, T. Matsumoto, T. Kida, A. Shinohara, S. Fukamachi, T. Shinohara, and S. Arikawa, "Speeding up string pattern matching by text compression. the dawn of a new era.," Transactions of Information Processing Society of Japan, pp. 370-384, 2001.
23. N. Ziviani, E. de Moura, G. Navarro, and R. Baeza-Yates, "Compression: A key for next-generation text retrieval systems," Computer, 2000.
24. "Modsecurity." http://www.modsecurity.org (accessed on July 2008).
25. T. Cormen, C. Leiserson, R. Rivest, and C. Stein, Introduction To Algorithms, The MIT Press and McGraw-Hill Book Company, 2001.