Single character frequency-based exclusive signature matching scheme

Studies in Computational Intelligence

Volumn 429, Issue , 2012, Pages 67-80

  Meng, Yuxin ^a   Li, Wenjuan ^b   Kwok, Lam For ^a  

^a CITY UNIVERSITY OF HONG KONG   (Hong Kong)

^b Zhaoqing Foreign Language College   (China)

Author keywords

Intelligent system; Intrusion detection; Network security; Signature matching

Indexed keywords

EID: 84863192150     PISSN: 1860949X     EISSN: None     Source Type: Book Series    
DOI: 10.1007/978-3-642-30454-5_5     Document Type: Conference Paper

References (26)

1. Paxson, V.: Bro: A System for Detecting Network Intruders in Real-Time. Computer Networks 31(23-24), 2435-2463 (1999)
2. Scarfone, K., Mell, P.: Guide to Intrusion Detection and Prevention Systems (IDPS). NIST Special Publication 800-94 (February 2007)
3. Roesch, M.: Snort: Lightweight intrusion detection for networks. In: Proceedings of Usenix Lisa Conference, pp. 229-238 (1999)
4. Dreger, H., Feldmann, A., Paxson, V., Sommer, R.: Operational experiences with highvolume network intrusion detection. In: Proceedings of ACM Conference on Computer and Communications Security, pp. 2-11 (2004) (Pubitemid 40338184)
5. Vigna, G., Kemmerer, R.A.: NetSTAT: a network-based Intrusion Detection Approach. In: Proceedings of Annual Computer Security Applications Conference, pp. 25-34 (1998)
6. Sommer, R., Paxson, V.: Outside the closed world: On using machine learning for network intrusion detection. In: IEEE Symposium on Security and Privacy, pp. 305-316 (2010)
7. Valdes, A., Anderson, D.: Statistical Methods for Computer Usage Anomaly Detection Using NIDES. Technical report, SRI International (January 1995)
8. Ghosh, A.K., Wanken, J., Charron, F.: Detecting Anomalous and Unknown Intrusions Against Programs. In: Proceedings of Annual Computer Security Applications Conference, pp. 259-267 (1998)
9. Snort, The Open Source Network Intrusion Detection System, http://www.snort.org/ (cited January 2012)
10. Rivest, R.L.: On the worst-case behavior of string-searching algorithms. SIAM Journal on Computing 6, 669-674 (1977)
11. Fisk, M., Varghese, G.: An analysis of fast string matching applied to content-based forwarding and intrusion detection. Technical Report CS2001-0670, University of California, San Diego (2002)
12. Markatos, E.P., Antonatos, S., Polychronakis, M., Anagnostakis, K.G.: Exclusion-based Signature Matching for Intrusion Detection. In: Proceedings of the IASTED International Conference on Communications and Computer Networks, pp. 146-152 (2002)
13. Markatos, K.G., Antonatos, S., Markatos, E.P., Polychronakis, M.: E2xB: A Domain- Specific String Matching Algorithm for Intrusion Detection. In: Proceedings of IFIP International Information Security Conference, pp. 217-228 (2003)
14. Boyer, R.S., Moore, J.S.: A fast string searching algorithm. Communications of the ACM 20(10), 762-772 (1977)
15. Horspool, R.: Practical fast searching in strings. Software Practice and Experience 10, 501-506 (1980)
16. Baboescu, F., Varghese, G.: Scalable packet classification. In: Proceedings of Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM), pp. 199-210 (2001) (Pubitemid 32981965)
17. Aho, A.V., Corasick, M.J.: Efficient string matching: An aid to bibliographic search. Communications of the ACM 18(6), 333-340 (1975)
18. Wu, S.,Manber, U.: A Fast Algorithm for Multi-Pattern Seaching. Technical Report TR- 94-17, Department of Computer Science. University of Arizona (May 1994)
19. Commentz-Walter, B.: StringMatching Algorithm Fast on the Average. In:Maurer, H.A. (ed.) ICALP 1979. LNCS, vol. 71, pp. 118-132. Springer, Heidelberg (1979)
20. Kim, K., Kim, Y.: A fast multiple string pattern matching algorithm. In: Proceedings of AoM/IAoM Conference on Computer Science (August 1999)
21. Lakshman, T.V., Stidialis, D.: High speed policy-based packet forwarding using efficient multi-dimensional range matching. In: Proceedings of Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, SIGCOMM, pp. 203-214 (1998) (Pubitemid 128566459)
22. Song, H., Lockwood, J.W.: Efficient packet classification for network intrusion detection using fpga. In: Proceedings of ACM/SIGDA International Symposium on Field Programmable Gate Arrays, FPGA, pp. 238-245 (2005) (Pubitemid 40787613)
23. Srinivasan, V., Varghese, G., Suri, S., Waldvogel, M.: Fast scalable level four switching. In: Proceedings of Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, SIGCOMM, pp. 191-202 (1998) (Pubitemid 128566458)
24. Gupta, P., McKeown, N.: Packet classification on multiple fields. In: Proceedings of Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, SIGCOMM, pp. 147-160 (1999) (Pubitemid 32081862)
25. Meng, Y., Kwok, L.-F.: Adaptive Context-aware Packet Filter Scheme using Statisticbased Blacklist Generation in Network Intrusion Detection. In: Proceedings of International Conference on Information Assurance and Security, IAS, pp. 74-79 (2011)
26. Sourdis, I., Dimopoulos, V., Pnevmatikatos, D., Vassiliadis, S.: Packet pre-filtering for network intrusion detection. In: Proceedings of ACM/IEEE Symposium on Architectures for Networking and Communications Systems, ANCS, pp. 183-192 (2006) (Pubitemid 47209686)