Curing regular expressions matching algorithms from insomnia, amnesia, and acalculia

ANCS'07 - Proceedings of the 2007 ACM Symposium on Architecture for Networking and Communications

Volumn , Issue , 2007, Pages 155-164

  Kumar, Sailesh ^a   Chandrasekaran, Balakrishnan ^a   Turner, Jonathan ^a   Varghese, George ^b  

^a UNIVERSITY OF WASHINGTON   (United States)

^b UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

deep packet inspection; DFA; regular expressions

Indexed keywords

DATA STREAM; DEEP PACKET INSPECTION; DETERMINISTIC FINITE AUTOMATA; MATCHING ALGORITHM; NETWORK INTRUSION DETECTION SYSTEMS; NETWORK LINKS; PACKET THROUGHPUT; PRACTICAL USE; REGULAR EXPRESSIONS; SECURITY DEVICES; SECURITY THREATS; VIRUS SIGNATURES;

COMPUTER VIRUSES; FINITE AUTOMATA; INTRUSION DETECTION; PACKET NETWORKS; ROBOTS; TRANSLATION (LANGUAGES); VIRUSES;

NETWORK SECURITY;

EID: 77954013621     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1323548.1323574     Document Type: Conference Paper

References (35)

1. R. Sommer, V. Paxson, "Enhancing Byte-Level Network Intrusion Detection Signatures with Context," ACM conf. on Computer and Communication Security, 2003, pp. 262-271.
2. J. E. Hopcroft and J. D. Ullman, "Introduction to Automata Theory, Languages, and Computation," Addison Wesley, 1979.
3. J. Hopcroft, "An nlogn algorithm for minimizing states in a finite automaton," in Theory of Machines and Computation, J. Kohavi, Ed. New York: Academic, 1971, pp. 189-196.
4. Bro: A System for Detecting Network Intruders in Real-Time. http://www.icir.org/vern/bro-info.html
5. M. Roesch, "Snort: Lightweight intrusion detection for networks," In Proc. 13th Systems Administration Conference (LISA), USENIX Association, November 1999, pp 229-238.
6. S. Antonatos, et. al, "Generating realistic workloads for network intrusion detection systems," In ACM Workshop on S & P, 2004.
7. A. V. Aho and M. J. Corasick, "Efficient string matching: An aid to bibliographic search," Comm. of the ACM, 18(6):333-340, 1975.
8. B. Commentz-Walter, "A string matching algorithm fast on the average," Proc. of ICALP, pages 118-132, July 1979.
9. S. Wu, U. Manber," A fast algorithm for multi-pattern searching," Tech. R. TR-94-17, Dept. of Comp. Science, Univ of Arizona, 1994.
10. Fang Yu, et al., "Fast and Memory-Efficient Regular Expression Matching for Deep Packet Inspection", UCB tech. report, 2005.
11. N. Tuck, T. Sherwood, B. Calder, and G. Varghese, "Deterministic memory-efficient string matching algorithms for intrusion detection," IEEE Infocom 2004, pp. 333-340.
12. L. Tan, and T. Sherwood, "A High Throughput String Matching Architecture for Intrusion Detection and Prevention," ISCA 2005.
13. I. Sourdis and D. Pnevmatikatos, "Pre-decoded CAMs for Efficient and High-Speed NIDS Pattern Matching," Proc. IEEE Symp. on Field-Prog. Custom Computing Machines, Apr. 2004, pp. 258-267.
14. S. Yusuf and W. Luk, "Bitwise Optimised CAM for Network Intrusion Detection Systems," IEEE FPL 2005.
15. R. Sidhu and V. K. Prasanna, "Fast regular expression matching using FPGAs," In IEEE Symposium on Field- Programmable Custom Computing Machines, Rohnert Park, CA, USA, April 2001.
16. C. R. Clark and D. E. Schimmel, "Efficient reconfigurable logic circuit for matching complex network intrusion detection patterns," In Proceedings of 13th International Conference on Field Program.
17. J. Moscola, et. al, "Implementation of a content-scanning module for an internet firewall," IEEE Workshop on FPGAs for Custom Comp. Machines, Napa, USA, April 2003.
18. R. W. Floyd, and J. D. Ullman, "The Compilation of Regular Expressions into Integrated Circuits", Journal of ACM, vol. 29, no. 3, pp 603-622, July 1982.
19. Scott Tyler Shafer, Mark Jones, "Network edge courts apps," http://infoworld.com/article/02/05/27/020527newebdev-.html
20. TippingPoint X505, www.tippingpoint.com/products-ps.html
21. Cisco IOS IPS Deployment Guide, www.cisco.com
22. Tarari RegEx, www. tarari.com/PDF/RegEx-ACT-HEET.pdf
23. N.J. Larsson, "Structures of string matching and data compression," PhD thesis, Dept. of Computer Science, Lund University, 1999.
24. S. Dharmapurikar, P. Krishnamurthy, T. Sproull, and J. Lockwood, "Deep Packet Inspection using Parallel Bloom Filters," IEEE Hot Interconnects 12, August 2003. IEEE Computer Society Press.
25. Z. K. Baker, V. K. Prasanna, "Automatic Synthesis of Efficient Intrusion Detection Systems on FPGAs," in Field Prog. Logic and Applications, Aug. 2004, pp. 311-321.
26. Y. H. Cho, W. H. Mangione-Smith, "Deep Packet Filter with Dedicated Logic and Read Only Memories," Field Prog. Logic and Applications, Aug. 2004, pp. 125-134.
27. M. Gokhale, et al., "Granidt: Towards Gigabit Rate Network Intrusion Detection Technology," in FPL, Sept. 2002, pp. 404-413.
28. J. Levandoski, E. Sommer, and M. Strait, "Application Layer Packet Classifier for Linux". http://l7-filter.sourceforge.net/.
29. "MIT DARPA Intrusion Detection Data Sets," http://www. ll.mit.edu/IST/ideval/data/2000/2000-ata-ndex.html.
30. Vern Paxson et al., "Flex: A fast scanner generator".
31. SafeXcel Content Inspection Engine, hardware regex acceleration IP.
32. Network Services Processor, OCTEON CN31XX, CN30XX Family.
33. Will Eatherton, John Williams, "An encoded version of reg-ex database from cisco systems provided for research purposes".
34. S. Kumar et al, "Algorithms to Accelerate Multiple Regular Expressions Matching for Deep Packet Inspection", in ACM SIGCOMM'06, Pisa, Italy, September 12-15, 2006.
35. S. Kumar, B. Chandrasekaran, J. Turner, and G. Varghese, "Curing Regular Expressions Matching Algorithms from Insomnia, Amnesia, and Acalculia", Washington University technical report, 2006.