MS-DFA: Multiple-Stride pattern matching for scalable deep packet inspection

Computer Journal

Volumn 54, Issue 2, 2011, Pages 285-303

  Vespa, Lucas ^a   Weng, Ning ^a   Ramaswamy, Ramaswamy ^b  

^a Southern Illinois University Carbondale   (United States)

^b CISCO SYSTEMS   (United States)

Author keywords

deep packet inspection; memory and performance optimization; network security; pattern matching

Indexed keywords

BASIC IDEA; COARSE-GRAINED; DEEP PACKET INSPECTION; DETERMINISTIC FINITE AUTOMATA; HIGH THROUGHPUT; MEMORY REQUIREMENTS; NETWORK INTRUSION DETECTION; NETWORK SPEED; PARALLEL COMPARISONS; PATTERN SET; PERFORMANCE EVALUATION; PERFORMANCE OPTIMIZATIONS; SPECIFIC HARDWARE; STATE EXPLOSION; STORAGE COSTS; STORAGE REQUIREMENTS;

FINITE AUTOMATA; INSPECTION; INTRUSION DETECTION; OPTIMIZATION; PACKET NETWORKS; PATTERN MATCHING;

NETWORK SECURITY;

EID: 79551525456     PISSN: 00104620     EISSN: 14602067     Source Type: Journal    
DOI: 10.1093/comjnl/bxq077     Document Type: Article

References (26)

1. Tuck, N., Sherwood, T., Calder, B. and Varghese, G. (2004) Deterministic Memory-Efficient String Matching Algorithms for Intrusion Detection. Proc. IEEE Infocom Conf., Hong Kong, China, March 7-11, pp. 333-340.
2. Denning, D. (1987) An intrusion-detection model. IEEE Trans. Softw. Eng., 13, 222-232.
3. Roesch, M. (1999) Snort-Lightweight Intrusion Detection for Networks. Proc. 13th Systems Administration Conf., Seatlle,WA, USA, November 7-12, pp. 229-238.
4. Bu, L. and Chandy, J.A. (2004) Fpga Based Network Intrusion Detection Using Content Addressable Memories. FCCM '04: Proc. 12th Annual IEEE Symp. Field-Programmable Custom Computing Machines, Napa Valley, CA, USA, April 20-23, pp. 316-317.
5. Paxson, V. (1999) Bro: a system for detecting network intruders in real-time. Comput. Netw., 31, 2435-2463.
6. Kumar, S., Dharmapurikar, S., Yu, F., Crowley, P. and Turner, J. (2006) Algorithms to Accelerate Multiple Regular Expressions Matching for Deep Packet Inspection. Proc. ACM SIGCOMM, Pisa, Italy, September 11-15, pp. 339-350.
7. Yu, F., Chen, Z., Diao, Y., Lakshman, T. and Katz, R.H. (2006) Fast and Memory-Efficient Regular Expression Matching for Deep Packet Inspection. Proc. Architectures for Networking and Communications Systems, San Jose, CA, USA, December 4-5, pp. 93-102.
8. Hua, N., Song, H. and Lakshman, T. (2009) Variable-Stride Multi-Pattern Matching for Scalable Deep Packet Inspection. IEEE INFOCOM 2009, Rio De Janeiro, Brazil, April 19-25, pp. 415-423.
9. Varghese, G. (2005) Network Algorithmics: An Interdisciplinary Approach to Designing Fast Networked Devices, (1st ed). Morgan Kaufmann.
10. Aho, A. and Corasick, M. (1975) Efficient string matching: an aid to bibliographic search. Commun. ACM, 18, 333-340.
11. Soewito, B., Vespa, L., Mahajan, A., Weng, N. and Wang, H. (2009) Self addressable memory-based fsm (sam-fsm): a scalable intrusion detection engine. IEEE Network Special Issue on Recent Developments in Network Intrusion Detection, 23, 14-21.
12. Vespa, L., Mathew, M. and Weng, N. (2009) P3fsm: Portable Predictive Pattern Matching Finite State Machine. 20th IEEE Int. Conf. Application-specific Systems, Architectures and Processors, Boston, MA, USA, July 7-9, pp. 219-222.
13. Wu, S. and Manber, U. (1994)A Fast Algorithm for Multi-pattern Searching. Technical Report, Department of Computer Science, Chung-Cheng University, Chia-Yi, Taiwan.
14. Song, T., Zhang, W., Wang, D. and Xue, Y. (2008) A Memory Efficient Multiple Pattern Matching Architecture for Network Security. 27th IEEE Int. Conf. Computer Communications, Phoenix, AZ, USA, April 13-18, pp. 166-170.
15. Snort Rule Database. http://www.snort.org/snort-rules.
16. Van Lunteren, J. (2006) High-performance Pattern-Matching for Intrusion Detection. 25th IEEE Int. Conf. Computer Communications, Barcelona, Spain, April 23-29, pp. 1-13.
17. Becchi, M. and Crowley, P. (2007) An Improved Algorithm to Accelerate Regular Expression Evaluation. Proc. ACM/IEEE Symp. Architectures for Networking and Communications Systems, Orlando, FL, USA, December 3-4, pp. 145-154.
18. Becchi, M. and Cadambi, S. (2007) Memory-Efficient Regular Expression Search Using State Merging. Proc. 26th IEEE Int. Conf. Computer Communications, Anchorage, AK, USA, May 6-12, pp. 1064-1072.
19. Tan, L. and Sherwood, T. (2005) A High Throughput String Matching Architecture for Intrusion Detection and Prevention. ISCA '05: Proc. 32nd Annual Int. Symp. Computer Architecture, Madison, WI, USA, June 4-8, pp. 112-122.
20. Hong, Y.D., Ke, X. and Yong, C. (2006) An Improved Wu-Manber Multiple Patterns Matching Algorithm. 25th IEEE Int. Performance, Computing, and Communications Conf., Phoenix, AZ, USA, April 10-12, pp. 680-686.
21. Brodie, B.C., Taylor, D.E. and Cytron, R.K. (2006) A scalable architecture for high-throughput regular-expression pattern matching. SIGARCH Comput. Archit. News, 34, 191-202.
22. Vespa, L. and Weng, N. (2009) Deterministic Finite Automata Characterization for Memory- Based Pattern Matching. Information and Communications Security, ICICS 2009, Lecture Notes in Computer Science 5927, Beijing, China, pp. 268-282. Springer.
23. Vespa, L. and Weng, N. (2009) Split-dfa (sdfa) for Scalable Pattern Matching in Network Security. SAM '09: Proc. 2009 Int. Conf. Security and Management, Las Vegas, NV, USA, July 13-16, pp. 469-474.
24. LSI Corporation (2010) LSI Tarari T2000.
25. Cavium Networks (2010) Cavium NITROX CN17XX.
26. Netlogic Microsystems (2010) Netlogic NLS2008 NETL7.