Fast regular expression matching using small tcams for network intrusion detection and prevention systems

Proceedings of the 19th USENIX Security Symposium

Volumn , Issue , 2010, Pages 111-126

  Meiners, Chad R ^a   Patel, Jignesh ^a   Norige, Eric ^a   Torng, Eric ^a   Liu, Alex X ^a  

^a Michigan State University   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

INTRUSION DETECTION; LOGIC GATES; PATTERN MATCHING;

DEEP PACKET INSPECTION; NETWORK INTRUSION DETECTION AND PREVENTION SYSTEMS; NETWORKING DEVICES; PACKET CLASSIFICATION; REGULAR EXPRESSIONS; REGULAR-EXPRESSION MATCHING; SECURITY DEVICES; TERNARY CONTENT ADDRESSABLE MEMORY;

TERNARY CONTENT ADRESSABLE MEMORY;

EID: 85076292285     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (35)

1. B. Agrawal and T. Sherwood. Modeling TCAM power for next generation network devices. In Proc. IEEE Int. Symposium on Performance Analysis of Systems and Software, 2006.
2. A. V. Aho and M. J. Corasick. Efficient string matching: an aid to bibliographic search. Communications of the ACM, 1975.
3. M. Alicherry, M. Muthuprasanna, and V. Kumar. High speed pattern matching for network IDS/IPS. In Proc. ICNP, 2006.
4. M. Becchi and S. Cadambi. Memory-efficient regular expression search using state merging. In Proc. INFOCOM, 2007.
5. M. Becchi and P. Crowley. A hybrid finite automaton for practical deep packet inspection. In Proc. CoNext, 2007.
6. M. Becchi and P. Crowley. An improved algorithm to accelerate regular expression evaluation. In Proc. ANCS, 2007.
7. M. Becchi and P. Crowley. Efficient regular expression evaluation: Theory to practice. In Proc. ANCS, 2008.
8. M. Becchi and P. Crowley. Extending finite automata to efficiently match perl-compatible regular expressions. In Proc. CoNEXT, 2008.
9. M. Becchi, M. Franklin, and P. Crowley. A workload for evaluating deep packet inspection architectures. In Proc. IEEE IISWC, 2008.
10. M. Becchi, C. Wiseman, and P. Crowley. Evaluating regular expression matching engines on network and general purpose processors. In Proc. ANCS, 2009.
11. A. Bremler-Bar, D. Hay, and Y. Koral. CompactDFA: generic state machine compression for scalable pattern matching In Proc. INFOCOM, 2010.
12. B. C. Brodie, D. E. Taylor, and R. K. Cytron. A scalable architecture for high-throughput regular-expression pattern matching. SIGARCH Computer Architecture News, 2006.
13. C. R. Clark and D. E. Schimmel. Efficient reconfigurable logic circuits for matching complex network intrusion detection patterns. In Proc. FPL, pages 956–959, 2003.
14. C. R. Clark and D. E. Schimmel. Scalable pattern matching for high speed networks. In FCCM 2004.
15. J. E. Hopcroft. The Theory of Machines and Computations, chapter An nlogn algorithm for minimizing the states in a finite automaton, pages 189–196. Academic Press, 1971.
16. S. Kong, R. Smith, and C. Estan. Efficient signature matching with multiple alphabet compression tables. In Proc. ACM SecureComm, Article 1, 2008.
17. S. Kumar, B. Chandrasekaran, J. Turner, and G. Varghese. Curing regular expressions matching algorithms from insomnia, amnesia, and acalculia. In Proc. ACM/IEEE ANCS, pages 155–164, 2007.
18. S. Kumar, S. Dharmapurikar, F. Yu, P. Crowley, and J. Turner. Algorithms to accelerate multiple regular expressions matching for deep packet inspection. In Proc. SIGCOMM, 2006.
19. S. Kumar, J. Turner, and J. Williams. Advanced algorithms for fast and scalable deep packet inspection. In Proc. ANCS, pages 81–92, 2006.
20. C. R. Meiners, A. X. Liu, and E. Torng. TCAM Razor: A systematic approach towards minimizing packet classifiers in TCAMs. In Proc. ICNP, 2007.
21. C. R. Meiners, A. X. Liu, and E. Torng. Bit weaving: A non-prefix approach to compressing packet classifiers in TCAMs. In Proc. ICNP, 2009.
22. A. Mitra, W. Najjar, and L. Bhuyan. Compiling PCRE to FPGA for accelerating SNORT IDS. In Proc. ACM/IEEE ANCS, 2007.
23. J. Moscola, J. Lockwood, R. P. Loui, and M. Pachos. Implementation of a content-scanning module for an internet firewall. In FCCM, 2003.
24. R. Sidhu and V. K. Prasanna. Fast regular expression matching using fpgas. In FCCM, 2001.
25. R. Smith, C. Estan, and S. Jha. XFA: Faster signature matching with extended automata. In Proc. Symposium on Security and Privacy, 2008.
26. R. Smith, C. Estan, S. Jha, and S. Kong. Deflating the big bang: fast and scalable deep packet inspection with extended finite automata. In Proc. SIGCOMM, pages 207–218, 2008.
27. R. Sommer and V. Paxson. Enhancing bytelevel network intrusion detection signatures with context. In Proc. ACM CCS, pages 262–271, 2003.
28. I. Sourdis and D. Pnevmatikatos. Pnevmatikatos: Fast, large-scale string match for a 10gbps fpgabased network intrusion detection system. In Proc. FCCM, pages 880–889, 2003.
29. I. Sourdis and D. Pnevmatikatos. Pre-decoded cams for efficient and high-speed nids pattern matching. In Proc. FCCM, 2004.
30. J.-S. Sung, S.-M. Kang, Y. Lee, T.-G. Kwon, and B.-T. Kim. A multi-gigabit rate deep packet inspection algorithm using TCAM. In Proc. IEEE GLOBECOM, 2005.
31. S. Suri, T. Sandholm, and P. Warkhede. Compressing two-dimensional routing tables. Algorithmica, 2003.
32. L. Tan and T. Sherwood. A high throughput string matching architecture for intrusion detection and prevention. In Proc. ISCA, 2005.
33. N. Tuck, T. Sherwood, B. Calder, and G. Varghese. Deterministic memory-efficient string matching algorithms for intrusion detection. In Proc. IEEE Infocom, pages 333–340, 2004.
34. F. Yu, Z. Chen, Y. Diao, T. V. Lakshman, and R. H. Katz. Fast and memory-efficient regular expression matching for deep packet inspection. In Proc. ANCS, 2006.
35. F. Yu, R. H. Katz, and T. V. Lakshman. Gigabit rate packet pattern-matching using TCAM. In Proc. ICNP, 2004.