Robust and fast pattern matching for intrusion detection

Proceedings - IEEE INFOCOM

Volumn , Issue , 2010, Pages

  Namjoshi, Kedar ^a   Narlikar, Girija ^a  

^a LUCENT TECHNOLOGIES   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ATTACK PATTERNS; BACKTRACKING ALGORITHM; COMPILE TIME; COMPLEXITY BOUNDS; DENIAL OF SERVICE ATTACKS; DETERMINISTIC ALGORITHMS; INTRUSION DETECTION SYSTEMS; LOW COMPLEXITY; MATCHING ALGORITHM; PROCESSING RATES; REGULAR EXPRESSIONS; SINGLE-RULE; WORST-CASE PERFORMANCE;

ALGORITHMS; COMPUTER CRIME; LINGUISTICS; PATTERN MATCHING; SYNTACTICS;

INTRUSION DETECTION;

EID: 77953312244     PISSN: 0743166X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INFCOM.2010.5462149     Document Type: Conference Paper

References (36)

1. R. Cox, "Regular expression matching can be simple and fast," http://swtch.com/ rsc/regexp/regexp1.html.
2. -, "Implementing regular expressions," http://swtch.com/ rsc/regexp/.
3. S. Crosby, "Denial of service through regular expressions," usenix Security Symposium Work-in-Progress, http://www.usenix.org/events/sec03/ wips.html.
4. K. Thompson, "Regular expression search algorithm," Commun. ACM, vol. 11, no. 6, pp. 419-422, 1968.
5. T. S. S. Alert, "Buffer overflow on procedures of the replication management api packages," http://www.appsecinc.com/resources/alerts/oracle/ 2004-0001/25.html.
6. A. V. Aho, "Algorithms for finding patterns in strings," in Handbook of Theoretical Computer Science, Volume A: Algorithms and Complexity (A). Elsevier, 1990, pp. 255-300.
7. L. Tan, B. Brotherton, and T. Sherwood, "Bit-split string-matching engines for intrusion detection and prevention," ACM Trans. Archit. Code Optim., vol. 3, no. 1, pp. 3-34, 2006.
8. I. Sourdis, V. Dimopoulos, D. Pnevmatikatos, and S. Vassiliadis, "Packet pre-filtering for network intrusion detection," in Proc. ACM/IEEE ANCS, 2006, pp. 183-192.
9. D. L. Schuff and V. S. Pai, "Design alternatives for a high-performance self-securing ethernet network interface," in IPDPS, 2007, pp. 1-10.
10. F. Yu, R. Katz, and T. Lakshman, "Gigabit rate packet pattern-matching using tcam," in ICNP, 2004.
11. C. R. Clark and D. E. Schimmel, "Scalable pattern matching for high speed networks," in FCCM. IEEE Computer Society, 2004, pp. 249-257.
12. Brodie, Cytron, and Taylor, "A scalable architecture for high-throughput regular-expression pattern matching," CANEWS: ACM SIGARCH Computer Architecture News, vol. 34, 2006.
13. A. Ghosh and J. Voas, "Inoculating software for survivability," Commun. ACM, vol. 42, no. 7, pp. 38-44, 1999.
14. W. Drewry and T. Ormandy, "Insecure context switching: inoculating regular expressions for survivability," in WOOT'08: Proceedings of the 2nd conference on USENIX Workshop on offensive technologies.
15. K. Ellul, B. Krawetz, J. Shallit, and M. Wang, "Regular expressions: new results and open problems," J. Autom. Lang. Comb., vol. 9, no. 2-3, pp. 233-256, 2004.
16. V. Laurikari, "Nfas with tagged transitions, their conversion to deterministic automata and application to regular expressions," pp. 181-187, 2000, http://laurikari.net/ville/spire2000-tnfa.ps.
17. T. M. Corporation, "Can-2005-2491," August 2000, http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491.
18. grep(1), "In gnu project manual pages," 2002.
19. J. Friedl, Mastering Regular Expressions. O'Reilly Media, Inc., 2006.
20. W. Lee, J. D. Cabrera, A. Thomas, N. Balwalli, S. Saluja, and Y. Zhang, "Performance adaptation in real-time intrusion detection systems," in RAID, 2002, pp. 252-273.
21. M. Becchi and P. Crowley, "Extending finite automata to efficiently match perl-compatible regular expressions," in CONEXT '08: Proceedings of the 2008 ACM CoNEXT Conference, pp. 1-12.
22. S. Kumar, S. Dharmapurikar, F. Yu, P. Crowley, and J. Turner, "Algorithms to accelerate multiple regular expressions matching for deep packet inspection," in Proc. SIGCOMM, 2006, pp. 339-350.
23. M. Becchi and P. Crowley, "An improved algorithm to accelerate regular expression evaluation," in Proc. ACM/IEEE ANCS, 2007, pp. 145-154.
24. M. Becchi and S. Cadambi, "Memory-efficient regular expression search using state merging," in Proc. INFOCOM, 2007.
25. M. Becchi and P. Crowley, "A hybrid finite automaton for practical deep packet inspection," in Proc. ACM Conference on Emerging Network Experiment and Technology, CoNEXT, 2007.
26. R. Smith, C. Estan, S. Jha, and S. Kong, "Deflating the big bang: fast and scalable deep packet inspection with extended finite automata," in Proc. ACM SIGCOMM, 2008.
27. R. Sommer and V. Paxson, "Enhancing byte-level network intrusion detection signatures with context," in CCS '03: Proceedings of the 10th ACM conference on Computer and communications security.
28. A. V. Aho and M. J. Corasick, "Efficient string matching: An aid to bibliographic search," Commun. ACM, vol. 18, no. 6, pp. 333-340, 1975.
29. S. A. Crosby and D. S. Wallach, "Denial of service via algorithmic complexity attacks," in Proc. of the 12th USENIX Security Symposium, 2003, pp. 29-44.
30. R. Smith, C. Estan, and S. Jha, "Backtracking algorithmic complexity attacks against a nids," in ACSAC, 2006.
31. A. V. Aho, M. S. Lam, R. Sethi, and J. D. Ullman, Compilers: Principles, Techniques, & Tools, Second Edition. Addison-Wesley, 2007.
32. J. E. Hopcroft and J. D. Ullman, Introduction to Automata Theory, Languages, and Computation. Reading, Massachusetts: Addison- Wesley, 1979.
33. I. Sourcefire, "Snort - the de facto standard for intrusion," http://www.snort.org/.
34. DefCon.org, "Defcon convention," http://www.defcon.org/.
35. -, "Defcon 10 convention, capture the flag packet traces," http://cctf.shmoo.com/data/cctf-defcon10/orange.cctf.tar.gz.
36. -, "Defcon 8 convention, capture the flag packet traces," http://cctf.shmoo.com/data/cctf-defcon8/.