Space-time tradeoffs in software-based deep Packet Inspection

2011 IEEE 12th International Conference on High Performance Switching and Routing, HPSR 2011

Volumn , Issue , 2011, Pages 1-8

  Bremler Barr, Anat ^a   Harchol, Yotam ^b   Hay, David ^a  

^a INTERDISCIPLINARY CENTER   (Israel)

^b HEBREW UNIVERSITY OF JERUSALEM   (Israel)

Author keywords

[No Author keywords available]

Indexed keywords

CRITICAL PATHS; DEEP PACKET INSPECTION; MALWARES; NETWORK INTRUSION DETECTION; PACKET PROCESSING; SECURITY TOOLS; SOFTWARE-BASED; SPACE-TIME TRADEOFFS; WEB APPLICATION FIREWALLS;

COMPUTER SYSTEM FIREWALLS; INSPECTION; USER INTERFACES; VIRUSES;

PACKET NETWORKS;

EID: 80052761869     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/HPSR.2011.5985996     Document Type: Conference Paper

References (25)

1. A. Aho and M. Corasick, "Efficient string matching: an aid to bibliographic search," Communications of the ACM, pp. 333-340, 1975.
2. M. Becchi and P. Crowley, "An improved algorithm to accelerate regular expression evaluation," in ACM/IEEE ANCS, 2007.
3. U. Ben-Porat, A. Bremler-Barr, and H. Levy, "Evaluating the vulnerability of network mechanisms to sophisticated DDoS attacks," in IEEE INFOCOM, 2008.
4. A. Bremler-Barr, D. Hay, and Y. Koral, "CompactDFA: Generic state machine compression for scalable pattern matching," in IEEE INFOCOM, 2009.
5. Cachegrind (a Valgrind tool). [Online]. Available: http://valgrind.org/ info/tools.html
6. ClamAV, 2010. [Online]. Available: http://www.calmav.net
7. S. A. Crosby and D. S. Wallach, "Denial of service via algorithmic complexity attacks," in Usenix Security, 2003.
8. DARPA Intrusion Detection Data Sets, 1998. [Online]. Available: http://www.ll.mit.edu/mission/communications/ist/corpora/ideval/data/index.html
9. F. Yu, R.H. Katz, and T.V. Lakshman, "Gigabit rate packet patternmatching using TCAM," in IEEE ICNP, 2004.
10. M. Fisk and G. Varghese, "An analysis of fast string matching applied to content-based forwarding and intrusion detection," UCSD Technical Report CS2001-0670, 2002.
11. D. Huffman, "A method for the construction of minimum-redundancy codes," in Proceedings of the I.R.E., 1952, pp. 1098-1102.
12. D. E. Knuth, The art of computer programming, volume 3: sorting and searching. Addison Wesley Longman Publishing Co., Inc., 1973.
13. S. Kumar, J. Turner, P. Crowley, and M. Mitzenmacher, "HEXA: Compact data structures for faster packet processing," in IEEE ICNP, 2007.
14. S. Kumar, S. Dharmapurikar, F. Yu, P. Crowley, and J. S. Turner, "Algorithms to accelerate multiple regular expression matching for deep packet inspection," in ACM SIGCOMM, 2006.
15. W. Lin and B. Liu, "Pipelined parallel AC-based approach for multistring matching," in ICPADS, 2008.
16. M. D. McIlroy, "A killer adversary for quicksort," Software-Practice and Experience, pp. 341-344, 1999.
17. D. Pao, W. Lin, and B. Liu, "Pipelined architecture for multi-string matching," in Computer Architecture Letters, 2008.
18. T. Peters, 2003. [Online]. Available: http://mail.python.org/pipermail/ python-dev/2003-May/035916.html
19. R. Smith, C. Estan, and S. Jha, "Backtracking algorithmic complexity attacks against a NIDS," in Annual Computer Security Applications Conference December, 2006.
20. SNORT, 2010. [Online]. Available: http://www.snort.org
21. L. Tan and T. Sherwood, "Architectures for Bit-Split string scanning in intrusion detection," IEEE Micro, pp. 110-117, 2006. (Pubitemid 43380042)
22. N. Tuck, T. Sherwood, B. Calder, and G. Varghese, "Deterministic memory-efficient string matching algorithms for intrusion detection," in IEEE INFOCOM, 2004.
23. J. van Lunteren, "High-performance pattern-matching for intrusion detection," in IEEE INFOCOM, 2006.
24. F. Weimer, "Algorithmic complexity attacks and the linux networking code," http://www.enyo.de/fw/security/notes/linux-dst-cache-dos.html.
25. Y. Weinsberg, S. Tzur-David, D. Dolev, and T. Anker, "High performance string matching algorithm for a network intrusion prevention system (NIPS)," in IEEE HPSR, 2006.