Approximate Reduction of Finite Automata for High-Speed Network Intrusion Detection

Abstract

We consider the problem of approximate reduction of non-deterministic automata that appear in hardware-accelerated network intrusion detection systems (NIDSes). We define an error distance of a reduced automaton from the original one as the probability of packets being incorrectly classified by the reduced automaton (wrt the probabilistic distribution of packets in the network traffic). We use this notion to design an approximate reduction procedure that achieves a great size reduction (much beyond the state-of-the-art language preserving techniques) with a controlled and small error. We have implemented our approach and evaluated it on use cases from Snort, a popular NIDS. Our results provide experimental evidence that the method can be highly efficient in practice, allowing NIDSes to follow the rapid growth in the speed of networks.

Approximate reduction of finite automata for high-speed network intrusion detection

“…Finally, we formulate two problems of approximate automata reduction via probabilistic distance. Proofs of the lemmas can be found in [43].…”

“…Further, it can be shown (cf. the proof of Lemma 1 in [43]) that the matrix Δ * , representing the significance of going from p to q via any w ∈ Σ * , can be computed as (I − Δ) −1 . Then, to get Pr P (L(A)), it suffices to take α • Δ * • γ.…”

“…We have implemented our approach in a Python prototype named Appreal (APProximate REduction of Automata and Languages) 4 and evaluated it on the use case of network intrusion detection using Snort [1], a popular open source NIDS. The version of Appreal used for the evaluation in the current paper is available as an artifact [44] for the TACAS'18 artifact virtual machine [45].…”