AC-suffix-tree: Buffer free string matching on out-of-sequence packets

Proceedings - 2011 7th ACM/IEEE Symposium on Architectures for Networking and Communications Systems, ANCS 2011

Volumn , Issue , 2011, Pages 36-44

  Chen, Xinming ^a   Ge, Kailin ^a   Chen, Zhen ^b   Li, Jun ^b  

^a TSINGHUA UNIVERSITY   (China)

^b TSINGHUA NATIONAL LABORATORY FOR INFORMATION SCIENCE AND TECHNOLOGY   (China)

Author keywords

Network Security; Packet Reordering; String Matching

Indexed keywords

AHO-CORASICK; BUFFERING STRATEGY; DENIAL OF SERVICE; DOS ATTACKS; FAST MEMORY; HIGH-SPEED LINKS; NOVEL ALGORITHM; ORDERS OF MAGNITUDE; OUT-OF-SEQUENCE PACKETS; PACKET REORDERING; REASSEMBLY; SEARCH PATTERNS; SIGNATURE DETECTION; STRING MATCHING; STRING MATCHING ALGORITHM; SUFFIX-TREES;

ALGORITHMS; FORESTRY; INTRUSION DETECTION; NETWORK ARCHITECTURE; NETWORK SECURITY; TRANSMISSION CONTROL PROTOCOL;

TREES (MATHEMATICS);

ALGORITHMS; MATHEMATICS; SYSTEMS ENGINEERING;

EID: 81255143544     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ANCS.2011.14     Document Type: Conference Paper

References (12)

1. DARPA Intrusion Detection Data Sets. HTTP://www.ll.mit.edu/mission/ communications/ist/corpora/ideval/data/index.html.
2. A. V. Aho and M. J. Corasick. Efficient string matching: an aid to bibliographic search. Communications of the ACM, 18(6):333-340, 1975.
3. J. C. R. Bennett. Packet reordering is not pathological network behavior. IEEE/ACM Transactions on Networking, 7(6):789-798, 1999.
4. T. H. Cormen, C. E. Leiserson, and R. L. Rivest. Introduction to Algorithms. Prentice Hall, 1998.
5. M. Crochemore, C. Hancart, and T. Lecroq. Algorithms on strings. Cambridge University Press, 2007.
6. S. Dharmapurikar and V. Paxson. Robust tcp stream reassembly in the presence of adversaries. In Proceedings of the 14th conference on USENIX Security Symposium - Volume 14, pages 5-5, 2005.
7. M. Handley, V. Paxson, and C. Kreibich. Network intrusion detection: evasion, traffic normalization, and end-to-end protocol semantics. In Proceedings of the 10th conference on USENIX Security Symposium - Volume 10, SSYM'01, pages 9-9, 2001.
8. M. Roesch. Snort - lightweight intrusion detection for networks. In the 13th USENIX Conference on System Administration, 1999.
9. G. Varghese, J. A. Fingerhut, and F. Bonomi. Detecting evasion attacks at high speeds without reassembly. SIGCOMM Comput. Commun. Rev., 36:327-338, August 2006. (Pubitemid 44623738)
10. M. Vutukuru, H. Balakrishnan, and V. Paxson. Efficient and robust tcp stream normalization. In Security and Privacy, 2008. SP 2008. IEEE Symposium on, pages 96 -110, May 2008.
11. J. Yu, Y. Xue, and J. Li. Memory efficient string matching algorithm for network intrusion management system. Tsinghua Science and Technology, 12(5):585 - 593, 2007.
12. M. Zhang and J.-b. Ju. Space-economical reassembly for intrusion detection system. In Information and Communications Security, volume 2836 of Lecture Notes in Computer Science, pages 393-404. Springer Berlin / Heidelberg.