Regular expression matching on graphics hardware for intrusion detection

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 5758 LNCS, Issue , 2009, Pages 265-283

  Vasiliadis, Giorgos ^a   Polychronakis, Michalis ^a   Antonatos, Spiros ^a   Markatos, Evangelos P ^a   Ioannidis, Sotiris ^a  

^a INSTITUTE OF COMPUTER SCIENCE   (Greece)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTATIONAL POWER; CPU CYCLES; DATA PARALLELISM; EXPRESSIVE POWER; FLEXIBLE PATTERNS; GRAPHICS HARDWARE; GRAPHICS PROCESSING UNITS; IN-NETWORK; INTRUSION DETECTION SYSTEMS; MULTIPLE INPUTS; PACKET PROCESSING; REGULAR EXPRESSIONS; REGULAR-EXPRESSION MATCHING; SPAM FILTERING; VIRUS SCANNERS;

COMPUTER VIRUSES; GENE EXPRESSION; PATTERN MATCHING; PROGRAM PROCESSORS; VIRUSES;

INTRUSION DETECTION;

EID: 76649131237     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-04342-0_14     Document Type: Conference Paper

References (31)

1. Pcre: Perl compatible regular expressions, http://www.pcre.org
2. Testing intrusion detection systems: a critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by lincoln laboratory. ACM Trans. Inf. Syst. Secur. 3(4), 262-294 (2000)
3. Aho, A.V., Corasick, M.J.: Efficient string matching: an aid to bibliographic search. Communications of the ACM 18(6), 333-340 (1975)
4. Becchi, M., Crowley, P.: A hybrid finite automaton for practical deep packet inspection. In: CoNEXT 2007: Proceedings of the 2007 ACM CoNEXT conference, pp. 1-12. ACM, New York (2007)
5. Berk, E., Ananian, C.: Jlex: A lexical analyzer generator for java, http://www.cs.princeton.edu/~appel/modern/java/JLex/
6. Berry, G., Sethi, R.: From regular expressions to deterministic automata. Theor. Comput. Sci. 48(1), 117-126 (1986)
7. Clark, C.R., Schimmel, D.E.: Efficient reconfigurable logic circuits for matching complex network intrusion detection patterns, pp. 956-959 (2003)
8. Cook, D.L., Ioannidis, J., Keromytis, A.D., Luck, J.: Cryptographics: Secret key cryptography using graphics cards. In: Menezes, A. (ed.) CT-RSA 2005. LNCS, vol. 3376, pp. 334-350. Springer, Heidelberg (2005)
9. Floyd, R.W., Ullman, J.D.: The compilation of regular expressions into integrated circuits. J. ACM 29(3), 603-622 (1982)
10. Goyal, N., Ormont, J., Smith, R., Sankaralingam, K., Estan, C.: Signature matching in network processing using SIMD/GPU architectures. Technical Report TR1628 (2008)
11. Harrison, O., Waldron, J.: Practical symmetric key cryptography on modern graphics hardware. In: Proceedings of the 17th USENIX Security Symposium, Berkeley, CA, USA, July 2008, pp. 195-209. USENIX Association (2008)
12. Hopcroft, J.E., Ullman, J.D.: Introduction To Automata Theory, Languages, And Computation. Addison-Wesley Longman Publishing Co., Inc., Boston (1990)
13. Huang, N.-F., Hung, H.-W., Lai, S.-H., Chu, Y.-M., Tsai, W.-Y.: A gpu-based multiple-pattern matching algorithm for network intrusion detection systems. In: Proceedings of the 22nd International Conference on Advanced Information Networking and Applications (AINA), pp. 62-67
14. Jacob, N., Brodley, C.: Offloading IDS computation to the GPU. In: Proceedings of the 22nd Annual Computer Security Applications Conference on Annual Computer Security Applications Conference (ACSAC 2006), Washington, DC, USA, pp. 371-380. IEEE Computer Society, Los Alamitos (2006)
15. Kumar, S., Chandrasekaran, B., Turner, J., Varghese, G.: Curing regular expressions matching algorithms from insomnia, amnesia, and acalculia. In: ANCS 2007: Proceedings of the 3rd ACM/IEEE Symposium on Architecture for networking and communications systems, pp. 155-164. ACM, New York (2007)
16. Kumar, S., Dharmapurikar, S., Yu, F., Crowley, P., Turner, J.: Algorithms to accelerate multiple regular expressions matching for deep packet inspection. In: SIGCOMM 2006: Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications, pp. 339-350. ACM, New York (2006)
17. Richard III, G.G., Marziale, L., Roussev, V.: Massive threading: Using GPUs to increase the performance of digital forensics tools. Digital Investigation 1, 73-81 (2007)
18. Moscola, J., Lockwood, J., Loui, R.P., Pachos, M.: Implementation of a content-scanning module for an internet firewall. In: FCCM, pp. 31-38 (2003)
19. NVIDIA. NVIDIA CUDA Compute Unified Device Architecture Programming Guide, version 1.1, http://developer.download.nvidia.com/compute/cuda/1-1/ NVIDIA-CUDA-Programming-Guide-1.1.pdf
20. Paxson, V.: Bro: A system for detecting network intruders in real-time. In: Proceedings of the 7th conference on USENIX Security Symposium (SSYM 1998), Berkeley, CA, USA, p. 3. USENIX Association (1998)
21. Roesch, M.: Snort: Lightweight intrusion detection for networks. In: Proceedings of the 1999 USENIX LISA Systems Administration Conference (November 1999)
22. Rubin, S., Jha, S., Miller, B.: Protomatching Network Traffic for High Throughput Network Intrusion Detection. In: Proceedings of the 13th ACM conference on Computer and Communications Security (CCS), pp. 47-58
23. Scarpazza, D.P., Villa, O., Petrini, F.: Exact multi-pattern string matching on the cell/b.e. processor. In: CF 2008: Proceedings of the 2008 conference on Computing frontiers, pp. 33-42. ACM, New York (2008)
24. Sidhu, R., Prasanna, V.: Fast regular expression matching using FPGAs. In: IEEE Symposium on Field-Programmable Custom Computing Machines, FCCM 2001 (2001)
25. Smith, R., Estan, C., Jha, S.: Backtracking algorithmic complexity attacks against a nids. In: ACSAC 2006: Proceedings of the 22nd Annual Computer Security Applications Conference on Annual Computer Security Applications Conference, Washington, DC, USA, pp. 89-98. IEEE Computer Society, Los Alamitos (2006)
26. Smith, R., Estan, C., Jha, S.: Xfa: Faster signature matching with extended automata. In: IEEE Symposium on Security and Privacy, pp. 187-201. IEEE Computer Society, Los Alamitos (2008)
27. Smith, R., Goyal, N., Ormont, J., Sankaralingam, K., Estan, C.: Evaluating GPUs for network packet signature matching. In: Proceedings of the International Symposium on Performance Analysis of Systems and Software, ISPASS (2009)
28. Sommer, R., Paxson, V.: Enhancing byte-level network intrusion detection signatures with context. In: CCS 2003: Proceedings of the 10th ACM conference on Computer and communications security, pp. 262-271. ACM, New York (2003)
29. Thompson, K.: Programming techniques: Regular expression search algorithm. Commun. ACM 11(6), 419-422 (1968)
30. Vasiliadis, G., Antonatos, S., Polychronakis, M., Markatos, E.P., Ioannidis, S.: Gnort: High performance network intrusion detection using graphics processors. In: Lippmann, R., Kirda, E., Trachtenberg, A. (eds.) RAID 2008. LNCS, vol. 5230, pp. 116-134. Springer, Heidelberg (2008)
31. Yu, F., Chen, Z., Diao, Y., Lakshman, T.V., Katz, R.H.: Fast and memory-efficient regular expression matching for deep packet inspection. In: ANCS 2006: Proceedings of the 2006 ACM/IEEE symposium on Architecture for networking and communications systems, pp. 93-102. ACM, New York (2006)