Deterministic memory-efficient string matching algorithms for intrusion detection

Proceedings - IEEE INFOCOM

Volumn 4, Issue , 2004, Pages 2628-2639

  Tuck, Nathan ^a   Sherwood, Timothy ^b   Calder, Brad ^a   Varghese, George ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b University of California at Santa Barbara   (United States)

Author keywords

Network Algorithms; System Design

Indexed keywords

INTRUSION DETECTION SYSTEMS (IDS); NETWORK ALGORITHMS; STRING MATCHING ALGORITHMS;

ALGORITHMS; CHARACTER RECOGNITION; COMPUTER CRIME; DATA STORAGE EQUIPMENT; PACKET NETWORKS; PROGRAM PROCESSORS; SYSTEMS ANALYSIS;

SECURITY OF DATA;

EID: 8344251916     PISSN: 0743166X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INFCOM.2004.1354682     Document Type: Conference Paper

References (21)

1. A. V. Aho and M. J. Corasick. Efficient string matching: An aid to bibliographic search. Communications of the ACM, 18(6): 33 3-340, 1975.
2. S. Antonatos, K. G. Anagnostakis, and E. P. Markatos. Generating realistic workloads for network intrusion detection systems. In ACM Workshop on Software and Performance. 2004.
3. R. S. Boyer and J. S. Moore. A fast string searching algorithm. Communications of the ACM. 20(10):761-772, 1977.
4. A. L. Buchsbaum, G. S. Fowler, B. Krishnamurthy, K. Vo, and J. Wang. Fast prefix matching of bounded strings. In Fifth Workshop on Algorithm Engineering and Experiments (ALENEX03), 2003.
5. CERT/CC. Code Red worm exploiting buffer overflow in US indexing service DLL. CERT Advisory CA-2001-19. Jan 2002.
6. B. Commentz-Walter. A string matching algorithm fast on the average. Proceedings of ICALP, pages 118-132. July 1979.
7. C. Cowan, S. Arnold, S. Beattie, C. Wright, and J. Viega. Defcon capture the flag: Defending vulnerable code from intense attack. In DARPA DISCEX III Conference, Washington DC, April 2003.
8. M. Degermark, A. Brodnik, S. Carlsson, and S. Pink. Small forwarding tables for fast routing lookups. In Proceedings of SIGCOMM, pages 3-14, 1997.
9. S. Dharmapurikar, P. Krishnamurthy, T. Sproull, and J. Lockwood. Deep packet inspection using parallel bloom filters. In 11th Symposium on High Performance Interconnects, August 2003.
10. W. Eatherton. Hardware-based internet protocol prefix lookups. Washington University Electrical Engineering Department (MS Thesis), May 1999.
11. W. Eatherton, Z. Dittia, and G. Varghese. Tree bitmap: Hardware/software ip lookups with incremental updates. Unpublished. 2002.
12. U. Manber and S. Wu. GLIMPSE: A tool to search through entire file systems. In Proceedings of the USENIX Winter 1994 Technical Conference, pages 23-32. San Fransisco, CA. USA. 17-21 1994.
13. E.P. Markatos, S. Antonatos, M. Polychronakis, and K.G. Anagnostakis. Exclusion-based signature matching for intrusion detection. In Proceedings of the IASTED International Conference on Communications and Computer Networks (CCN). pages 146-152. November 2002.
14. M. Roesch. Snort - lightweight intrusion detection for networks. In Proceedings of USA '99: 13th Systems Administration Conference, pages 229-238, November 1999.
15. M. Sanchez, E. Biersack, and W. Dabbous. Survey and taxonomy of IP address lookup algorithms. IEEE Network Magazine, 15(2):8-23, 2001.
16. T. Sherwood, G. Varghese, and B. Calder. A pipelined memory architecture for high throughput network processors. In 30th International Symposium on Computer Architecture, June 2003.
17. P. Shivakumar and N. P. Jouppi. Cacti 3.0: An integrated cache timing, power, and area model. Technical Report 2001/2. Compaq Western Research Laboratory, August 2001.
18. B.W. Watson. The performance of single-keyword and multiple-keyword pattern matching algorithms. Technical Report 94/19, Eindhoven University of Technology, 1994.
19. B.W. Watson and G. Zwaan. A taxonomy of keyword pattern matching algorithms. In H. A. Wijshoff, editor, Proceedings Computing Science in the Netherlands 93, pages 25-39, SION, Stichting Mathematish Centrum, 1993.
20. S. Wu and U. Manber. Agrep - a fast approximate pattern-matching tool. In Proceedings USENIX Winter 1992 Technical Conference, pages 153-162, San Francisco. CA, 1992.
21. S. Wu and U. Manber. A fast algorithm for multi-pattern searching. Technical Report TR-94-17. Department of Computer Science, University of Arizona. 1994.