A Flexible Pattern-Matching Algorithm for Network Intrusion Detection Systems Using Multi-Core Processors

Lee, Chun-Liang; Yang, Tzu-Hao

doi:10.3390/a10020058

Cited by 5 publications

(2 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The software-based methods using general-purpose processors provide greater flexibility and programmability compared with the hardware-based solutions. In the studies numbered [121,122] and [123], approaches that combine the advantages of NFA and DFA applications are proposed in order to benefit from multi-core architectures efficiently. It is aimed to increase the matching performance by using the existing parallelism provided by multi-core processors with the algorithm proposed in the study numbered [121] in which complex REs are divided and assigned to different cores.…”

Section: Acceleration Techniques For Dpimentioning

confidence: 99%

“…In this direction, the HBM algorithm focuses on reducing the used memory space and increasing the matching speed. Contrary to the HBM algorithm which creates the head-body finite automaton according to the predefined depth values, the FHBM algorithm proposed in the study numbered [123] divides the head and body parts according to the head size. Accordingly, this study proposes an algorithm focusing on increasing the efficiency obtained in the pattern matching process by providing a more flexible structure in terms of AC-DFA partitioning.…”

Section: Acceleration Techniques For Dpimentioning

confidence: 99%

See 1 more Smart Citation

Modern ağ trafiği analizi için derin paket incelemesi hakkında kapsamlı bir çalışma: sorunlar ve zorluklar

Çelebi

ÖZBİLEN

Yavanoğlu

2022

NÖHÜ Müh. Bilim. Derg.

View full text Add to dashboard Cite

Deep Packet Inspection (DPI) provides full visibility into network traffic by performing detailed analysis on both packet header and packet payload. Accordingly, DPI has critical importance as it can be used in applications i.e network security or government surveillance. In this paper, we provide an extensive survey on DPI. Different from the previous studies, we try to efficiently integrate DPI techniques into network analysis mechanisms by identifying performance-limiting parameters in the analysis of modern network traffic. Analysis of the network traffic model with complex behaviors is carried out with powerful hybrid systems by combining more than one technique. Therefore, DPI methods are studied together with other techniques used in the analysis of network traffic. Security applications of DPI on Internet of Things (IoT) and Software-Defined Networking (SDN) architectures are discussed and Intrusion Detection Systems (IDS) mechanisms, in which the DPI is applied as a component of the hybrid system, are examined. In addition, methods that perform inspection of encrypted network traffic are emphasized and these methods are evaluated from the point of security, performance and functionality. Future research issues are also discussed taking into account the implementation challenges for all DPI processes.

show abstract

Section: Acceleration Techniques For Dpimentioning

confidence: 99%

Section: Acceleration Techniques For Dpimentioning

confidence: 99%

Modern ağ trafiği analizi için derin paket incelemesi hakkında kapsamlı bir çalışma: sorunlar ve zorluklar

Çelebi

ÖZBİLEN

Yavanoğlu

2022

NÖHÜ Müh. Bilim. Derg.

View full text Add to dashboard Cite

show abstract

Reinforcement-Learning Based Network Intrusion Detection with Human Interaction in the Loop

Liu

2021

Security, Privacy, and Anonymity in Computation, Communication, and Storage

View full text Add to dashboard Cite

NFA Based Regular Expression Matching on FPGA

Sert¹,

Bazlamaçcı²

2021

2021 International Conference on Computer, Information and Telecommunication Systems (CITS)

View full text Add to dashboard Cite

String matching is about finding all occurrences of a string within a given text, which is a classical but still a popular problem. String matching algorithms have important roles in various real world areas, such as web and security applications.In this work, we are interested in solving regular expression and hence string matching problem targeting especially the network intrusion detection systems (NIDS) field.An NIDS engine inspects both the header and the content of the packet and hence performs a type of deep packet inspection also. This inspection requires effective string matching techniques because each network packet should be checked and compared against maybe hundreds of possible malicious attacks at line speed. In this thesis, a detailed literature analysis is presented first that explains and classifies regular expression matching studies. Among these, studies exist that presents nondeterministic finite automata (NFA) based architectures and their novel mappings onto FPGA. In our study we select one such study [1] and further modify vi and enhance the NFA architecture already proposed. The reference study uses the modified-McNaughton-Yamada-algorithm and maps the resulting NFA into structural HDL for FPGA implementation. Our modification proposes to use a 2character based matching structure that yields better memory utilization. With our approach, the circuit for the NFA representation needs less number of states (hence flip-flops) and LUTs to perform the 2-character regular expression matching process. Within the scope of this thesis, an extensive evaluation study is performed using the well-known Snort IDS ruleset and the worst case evaluation is done using some intuitively and synthetically created regular expressions targeting Xilinx 7series FPGAs. Evaluation results are obtained using various performance metrics.

show abstract

A Flexible Pattern-Matching Algorithm for Network Intrusion Detection Systems Using Multi-Core Processors

Cited by 5 publications

References 33 publications

Modern ağ trafiği analizi için derin paket incelemesi hakkında kapsamlı bir çalışma: sorunlar ve zorluklar

Modern ağ trafiği analizi için derin paket incelemesi hakkında kapsamlı bir çalışma: sorunlar ve zorluklar

Reinforcement-Learning Based Network Intrusion Detection with Human Interaction in the Loop

NFA Based Regular Expression Matching on FPGA

Contact Info

Product

Resources

About