Network intrusion detection systems (NIDSs) are one of the latest developments in security. The matching of packet strings against collected signatures dominates signature-based NIDS performance. Network processors are also one of the fastest growing segments of the semiconductor market, because they are designed to provide scalable and flexible solutions that can accommodate change quickly and economically. This work presents a fast string-matching algorithm (called FNP) over the network processor platform that conducts matching sets of patterns in parallel. This design also supports numerous practical features such as case-sensitive string matching, signature prioritization, and multiple-content signatures. This efficient multiple-pattern matching algorithm utilizes the hardware facilities provided by typical network processors instead of employing the external lookup co-processors. To verify the efficiency and practicability of the proposed algorithm, it was implemented on the Vitesse IQ2000 network processor platform. The searching patterns used in the present experiments are derived from the well-known Snort ruleset cited by most open-source and commercial NIDSs. This work shows that combining our string-matching methodology, hashing engine supported by most network processors, and characteristics of current Snort signatures frequently improves performance and reduces number of memory accesses compared to conventional string-matching algorithms. Another contribution of this work is to highlight that, besides total number of searching patterns, shortest pattern length is also a major influence on NIDS multipattern matching algorithm performance.

No abstract

Stateful tracking is a popular technique in firewall filtering and state replication is used to provide reliable connectivity. This paper proposes a new approach for improving existing state replication protocols which ensure state consistency amongst the nodes of a stateful HA cluster. Our goal is to develop a new scheme which reduces the update overhead in the face of both low and high connection loads in order to maximize the capacity and scalability of a high availability cluster. A new representation called flow digest is proposed. Also the ways to use flow digest structures to update state changes, recover the connections after a failover, and solve the state inconsistency are presented. The main advantage of the proposed method is to reduce the bandwidth consumption on state replication. The simulation results show that the proposed scheme reduces the number of update messages and, more importantly, eliminates typically at least 86% of bandwidth consumption compared to current solutions.

Network Intrusion Detection Systems (NIDS) monitors packets on the network and attempts to discover if a hacker is attempting to break into a system. The matching of packet strings against collected signatures dominates signature-based NlDS performance. Network Processors are one of· the fastest growing segments of the semiconductor market. because they are designed to provide sca/able and flexible solutions that can accommodate change quicldy and economical/yo This work presents a fast string matching algorithm (called FNP) over lhe Network Processor platform that conducts matching sets of patterns in paral/el. FNP needs less number o[ memory accesses against conventionaL pattern-malching algorithms. Anather contribution of this work is to highlight that, besides lotal number of searching patterns. shortest pall ern length is also a major inf l uence on NlDS multi-pallern matching algorithm performance.

No abstract