Algorithms to speedup pattern matching for network intrusion detection systems

Computer Communications

Volumn 62, Issue , 2015, Pages 47-58

  Zheng, Kai ^a   Cai, Zhiping ^b   Zhang, Xin ^c   Wang, Zhijun ^d   Yang, Baohua ^a  

^a IBM CHINA RESEARCH LAB   (China)

^b NATIONAL UNIVERSITY OF DEFENSE TECHNOLOGY   (China)

^c CARNEGIE MELLON UNIVERSITY   (United States)

^d HONG KONG POLYTECHNIC UNIVERSITY   (Hong Kong)

Author keywords

Exclusive matching; Intrusion detection; Negative pattern; Pattern matching

Indexed keywords

BALANCING; COMPUTER CRIME; ELECTRIC POWER UTILIZATION; HIGH SPEED NETWORKS; LOGIC GATES; PATTERN MATCHING; STATIC RANDOM ACCESS STORAGE; TABLE LOOKUP; TERNARY CONTENT ADRESSABLE MEMORY;

EXCLUSIVE MATCHING; EXCLUSIVE PATTERNS; FINE-GRAINED PARALLELISM; MAXIMIZE THROUGHPUT; NEGATIVE PATTERN; NETWORK INTRUSION DETECTION SYSTEMS; PATTERN MATCHING ALGORITHMS; TERNARY CONTENT ADDRESSABLE MEMORY;

INTRUSION DETECTION;

EID: 84928829713     PISSN: 01403664     EISSN: 1873703X     Source Type: Journal    
DOI: 10.1016/j.comcom.2015.02.004     Document Type: Article

References (37)

1. 2005 FBI Computer Crime Survey. < http://www.digitalriver.com/v2.0-img/operations/naievigi/site/media/pdf/FBIccs2005.pdf >.
2. SNORT - the de facto standard for intrusion detection/prevention. < http://www.snort.org >.
3. A.V. Aho, and M.J. Corasick Efficient string matching: an aid to bibliographic search Commun. ACM 18 6 1975 333 340
4. R.S. Boyer, and J.S. Moore A fast string searching algorithm Commun. ACM 20 10 1977 762 772
5. M. Becchi, P. Crowley, A hybrid finite automaton for practical deep packet inspection, in: ACM International Conference on emerging Networking Experiments and Technologies Conference (CoNEXT), 2007.
6. Kun Huang, Linxuan Ding, Gaogang Xie, Dafang Zhang, Alex X. Liu, Kavé Salamatian, Scalable TCAM-based regular expression matching with compressed finite automata, in: ACM/IEEE Symposium on Architecture for Networking and Communications Systems (ANCS), 2013.
7. S. Kumar, S. Dharmapurikar, F. Yu, P. Crowley, J. Turner, Algorithms to Accelerate Multiple Regular Expressions Matching for Deep Packet Inspection, ACM SIGCOMM, 2006.
8. R. Smith, C. Estan, S. Jha, XFA: faster S signature matching with extended automata, in: IIEEE Symposium on Security and Privacy (S&P), 2008.
9. N. Tuck, T. Sherwood, B. Calder, G. Varghese, Deterministic memory-efficient string matching algorithms for intrusion detection, in: IEEE INFOCOM, 2004.
10. F. Yu, Z. Chen, Y. Diao, T.V. Lakshman, R.H. Katz, Fast and memory-efficient regular expression matching for deep packet inspection, in: ACM/IEEE symposium on Architecture for Networking and Communications Systems (ANCS), 2006.
11. S. Yun An efficient TCAM-based implementation of multi-pattern matching using covered state encoding IEEE Trans. Comput. 61 2 2012 213 221
12. C.J. Coit, S. Staniford, J. McAlerney, Towards faster string matching for intrusion detection or exceeding the speed of SNORT, in: DARPA Information Survivability Conference and Exposition (DISCEX II'01), 2001.
13. C. Kruegel, F. Valeur, Stateful intrusion detection for high-speed networks, in: IEEE Symposium on Research on Security and Privacy, 2002.
14. Chia-Mei Chen, Ya-Lin Chen, and Hsiao-Chung Lin An efficient network intrusion detection Comput. Commun. 33 4 2010 477 484
15. Phurivit Sangkatsanee, Naruemon Wattanapongsakorn, and Chalermpol Charnsripinyo Practical real-time intrusion detection using machine learning approaches Comput. Commun. 34 18 2011 2227 2235
16. D. Pao, N. Lam Or, C. Ray, and C. Cheung A memory-based NFA regular expression match engine for signature-based intrusion detection Comput. Commun. 36 10-11 2013 1255 1267
17. Bleeding snort. Blog about computer and network security and protection. < http://www.bleedingsnort.com >.
18. N.S. Artan, H.J. Chao, TriBiCa: trie bitmap content analyzer for high-speed network intrusion detection, in: IEEE INFOCOM, 2007.
19. S. Dharmapurikar, P. Krishnamurthy, T.S. Sproull, and J.W. Lockwood Deep packet inspection using parallel bloom filters IEEE Micro 24 2004
20. S. Dharmapurikar, and J.W. Lockwood Fast and scalable pattern matching for network intrusion detection systems IEEE J. Select. Areas Commun. 24 10 2006 1781 1792
21. C.R. Clark, D.E. Schimmel, Scalable pattern matching for high speed networks, in: IEEE Symposium on Field-Programmable Custom Computing Machines (FCCM'04), 2004.
22. F. Yu, R.H. Katz, T.V. Lakshman, Gigabit rate packet pattern-matching using TCAM in: Proceedings of the Network Protocols, 12th IEEE International Conference on (ICNP'04) IEEE Computer Society, 2004, pp. 174-183.
23. B.L. Hutchings, R. Franklin, D. Carver, Assisting network intrusion detection with reconfigurable hardware, in: IEEE symposium on Field-Programmable Custom Computing Machines (FCCM'02), Napa, USA, 2002.
24. Y.H. Cho, W.H. Mangione-Smith, Fast reconfiguring deep packet filter for 1+ gigabit network, in: IEEE Symposium on Field Programmable Custom Computing Machines (FCCM), 2005.
25. J.v. Lunteren, High-performance pattern-matching engine for intrusion detection, in: IEEE INFOCOM, 2006.
26. S. Dharmapurikar, J. Lockwood, Fast and scalable pattern matching for content filtering, in: ACM/IEEE Symposium on Architectures for Networking and Communications Systems, 2005.
27. G. Vasiliadis, M. Polychronakis, S. Loannidis, MIDeA: a multi-parallel intrusion-parallel intrusion detection architecture, in: ACM Conference on Computer and Communications Security (CCS), 2011.
28. K. Zheng, C. Hu, H. Lu, and B. Liu A TCAM-based distributed parallel IP lookup scheme and performance analysis ACM/IEEE Trans. Network. 14 4 2006 863 875
29. Chad R. Meiners, Jignesh Patel, Eric Norige, Eric Torng, and Alex X. Liu Fast regular expression matching using small TCAM IEEE/ACM Trans. Network. 22 1 2014 94 109
30. K. Peng, S. Tang, M. Chen, Chain-based DFA deflation for fast and scalable regular expression matching using TCAM, in: ACM/IEEE Seventh Symposium on Architectures for Networking and Communications Systems, 2011.
31. O. Rottenstreich, I. Keslassy, A. Hassidim, H. Kaplan, and E. Porat On finding an optimal TCAM encoding scheme for packet classification IEEE INFOCOM 2013 2013 2049 2057
32. Kirill Kogan, Sergey Nikolenko, Ori Rottenstreich, William Culhane, Patrick Eugster, SAX-PAC (Scalable And eXpressive PAcket Classification), in: SIGCOMM 2014, ACM, New York, NY, USA, pp. 15-26.
33. K. Peng, Q. Dong, M. Chen, TCAM-based DFA deflation: a novel approach to fast and scalable regular expression matching, in: 19th International Workshop on Quality of Service, (IWQoS), 2011.
34. Zhiping Cai, Zhijun Wang, Kai Zheng, and Jiannong Cao A distributed TCAM coprocessor architecture for integrated longest prefix matching, policy filtering and content filtering IEEE Trans. Comput. 62 3 2013 417 427
35. N. Dukkipati, and N. McKeown Why flow-completion time is the right metric for congestion control ACM SIGCOMM Comput. Commun. Rev. 36 2006 59 62
36. MIT DARPA Intrusion Detection Data Sets. < http://www.ll.mit.edu/mission/communications/ist/corpora/ideval/data/1999data.html >.
37. NetLogic Microsystems. < http://www.broadcom.com/products/Knowledge-Based-Processors/Layers-2 - -4 >.