Memory Efficient String Matching Algorithm for Network Intrusion Management System

被引：7

作者：

余建明

薛一波

李军

机构：

[1] Department of Automation Tsinghua University

[2] Tsinghua University Tsinghua National Laboratory for Information Science and Technology Tsinghua University Beijing 100084 China

[3] Research Institute of Information Technology Tsinghua University Beijing 100084 China

来源：

Tsinghua Science and Technology | 2007年 / 05期

关键词：

string matching; network intrusion management system (NIMS); Aho-Corasick (AC) algorithm;

D O I：

暂无

中图分类号：

TP393.08 [];

学科分类号：

0839 ; 1402 ;

摘要：

As the core algorithm and the most time consuming part of almost every modern network intrusion management system (NIMS), string matching is essential for the inspection of network flows at the line speed. This paper presents a memory and time efficient string matching algorithm specifically designed for NIMS on commodity processors. Modifications of the Aho-Corasick (AC) algorithm based on the distribution characteristics of NIMS patterns drastically reduce the memory usage without sacrificing speed in software implementations. In tests on the Snort pattern set and traces that represent typical NIMS workloads, the Snort performance was enhanced 1.48%-20% compared to other well-known alternatives with an automaton size reduction of 4.86-6.11 compared to the standard AC implementation. The results show that special characteristics of the NIMS can be used into a very effective method to optimize the algorithm design.

引用

页码：585 / 593

页数：9

共 50 条

[1] A Time- and Memory-Efficient String Matching Algorithm for Intrusion Detection Systems
Sheu, Tzu-Fang
Huang, Nen-Fu
Lee, Hsiao-Ping
[J]. GLOBECOM 2006 - 2006 IEEE GLOBAL TELECOMMUNICATIONS CONFERENCE, 2006,
[2] High performance string matching algorithm for a Network Intrusion Prevention System (NIPS)
Weinsberg, Yaron
Tzur-David, Shimrit
Dolev, Danny
Anker, Tal
[J]. HPSR: 2006 WORKSHOP ON HIGH PERFORMANCE SWITCHING AND ROUTING, 2006, : 147 - +
[3] A deterministic cost-effective string matching algorithm for Network Intrusion Detection System
Huang, Nen-Fu
Chu, Yen-Ming
Hsieh, Chen-Ying
Tsai, Chi-Hung
Tzang, Yih-Jou
[J]. 2007 IEEE INTERNATIONAL CONFERENCE ON COMMUNICATIONS, VOLS 1-14, 2007, : 1292 - +
[4] Deterministic memory-efficient string matching algorithms for intrusion detection
Tuck, N
Sherwood, T
Calder, B
Varghese, G
[J]. IEEE INFOCOM 2004: THE CONFERENCE ON COMPUTER COMMUNICATIONS, VOLS 1-4, PROCEEDINGS, 2004, : 2628 - 2639
[5] A Memory-Efficient Parallel String Matching for Intrusion Detection Systems
Kim, HyunJin
Hong, Hyejeong
Kim, Hong-Sik
Kang, Sungho
[J]. IEEE COMMUNICATIONS LETTERS, 2009, 13 (12) : 1004 - 1006
[6] An Efficient String Matching Algorithm Using Bidirectional and Parallel Processing Structure for Intrusion Detection System
Chang, Gwo-Ching
Lin, Yue-Der
[J]. KSII TRANSACTIONS ON INTERNET AND INFORMATION SYSTEMS, 2010, 4 (05): : 956 - 967
[7] A String Matching Based Intrusion Detection System for Gigabit Network
Pan, Shuxia
Sun, Wangjie
Zheng, Zhigao
Sun, Chang
[J]. PROCEEDINGS OF 2010 ASIA-PACIFIC YOUTH CONFERENCE ON COMMUNICATION, VOLS 1 AND 2, 2010, : 79 - +
[8] A fast determinate string matching algorithm for the network intrusion detection systems
Zhong, Cheng
Chen, Guo-Liang
[J]. PROCEEDINGS OF 2007 INTERNATIONAL CONFERENCE ON MACHINE LEARNING AND CYBERNETICS, VOLS 1-7, 2007, : 3173 - 3177
[9] Implementation of Karp-Rabin string matching algorithm in reconfigurable hardware for network Intrusion Prevention System
Botwicz, J
Buciak, P
Sapiecha, P
[J]. PHOTONICS APPLICATIONS IN ASTRONOMY, COMMUNICATIONS, INDUSTRY, AND HIGH-ENERGY PHYSICS EXPERIMENTS IV, 2006, 6159
[10] Memory-Efficient String Matching for Intrusion Detection Systems using a High-Precision Pattern Grouping Algorithm
Vakili, Shervin
Langlois, J. M. Pierre
Boughzala, Bochra
Savaria, Yvon
[J]. PROCEEDINGS OF THE 2016 SYMPOSIUM ON ARCHITECTURES FOR NETWORKING AND COMMUNICATIONS SYSTEMS (ANCS'16), 2016, : 37 - 42

← 1 2 3 4 5 →