Deterministic memory-efficient string matching algorithms for intrusion detection

Tuck, Nathan; Sherwood, Timothy; Calder, Brad; Varghese, George

doi:10.1109/infcom.2004.1354682

Cited by 309 publications

(286 citation statements)

References 10 publications

Supporting

Mentioning

268

Contrasting

Unclassified

Order By: Relevance

“…To reduce the memory requirement of the AC automaton, Tuck et al [12] have proposed starting with the nondeterministic AC automaton and using bitmaps and path compression.…”

Section: Resultsmentioning

confidence: 99%

“…Path compression has been used in several IP address lookup structures including tree bitmap [4] and hybrid shape-shifting tries [7]. These compression methods reduce the memory required to about 1/30-1/50 of that required by an AC DFA or a WuManber structure, and to slightly less than what required by SFK search [12]. However, lookups on path-compressed data require more computation at search time, e.g., more additions at each node to compute popcounts, thus requiring hardware support to achieve competitive performance.…”

Section: Resultsmentioning

confidence: 99%

“…Zha and Sahni [19] have suggested a compressed AC trie inspired by the work of Tuck et al [12]: they use bitmaps with multiple levels of summaries, as well as an aggressive path compaction. Zha and Sahni's technique requires 90% fewer additions to compute popcounts than Tuck et al [12]'s, and occupies 24%-31% less memory.…”

Section: Resultsmentioning

confidence: 99%

“…In this work, we focus on an adaptation of Tuck et al's [12] compressed NFA method. We choose to do so despite the fact that Zha and Sahni's [19] technique is 31% more spaceefficient and it requires 90% fewer popcount 1 success transition matches the current input.…”

Section: Tuck Et Al's Compressed Automatonmentioning

confidence: 99%

“…Our algorithm is inspired by those proposed by Tuck et al [12] and Zha and Sahni [19]. These algorithms are based on the Non-deterministic Finite Automaton (NFA) version of AC, and achieve significant memory reduction.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Highly compressed multi-pattern string matching on the cell broadband engine

Zha

Scarpazza

Sahni

2011

2011 IEEE Symposium on Computers and Communications (ISCC)

View full text Add to dashboard Cite

Abstract-With its 9 cores per chip, the IBM Cell/Broadband Engine (Cell) can deliver an impressive amount of compute power and benefit the string-matching kernels of network security, business analytics and natural language processing applications. However, the available amount of main memory on the system limits the maximum size of the dictionary supported by the string matching solution.To counter that, we propose a technique that employs compressed Aho-Corasick automata to perform fast, exact multipattern string matching with very large dictionaries. Our technique achieves the remarkable compression factors of 1:34 and 1:58, respectively, on the memory representation of Englishlanguage dictionaries and random binary string dictionaries. We demonstrate a parallel implementation for the Cell processor that delivers a sustained throughput between 0.90 and 2.35 Gbps per Cell blade, while supporting dictionary sizes up to 9.2 Million average patterns per Gbyte of main memory, and exhibiting resilience to content-based attacks.This high dictionary density enables natural language applications of an unprecedented scale to run on a single server blade.

show abstract

“…To reduce the memory requirement of the AC automaton, Tuck et al [12] have proposed starting with the nondeterministic AC automaton and using bitmaps and path compression.…”

Section: Resultsmentioning

confidence: 99%

Section: Resultsmentioning

confidence: 99%

Section: Resultsmentioning

confidence: 99%

Section: Tuck Et Al's Compressed Automatonmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Highly compressed multi-pattern string matching on the cell broadband engine

Zha

Scarpazza

Sahni

2011

2011 IEEE Symposium on Computers and Communications (ISCC)

View full text Add to dashboard Cite

show abstract

Untitled

Liu

et al. 2009

Concurrency and Computation

View full text Add to dashboard Cite

Anomaly‐based intrusion detection systems: The requirements, methods, measurements, and datasets

Hajj

Sibai

Abdo

et al. 2021

Trans Emerging Tel Tech

View full text Add to dashboard Cite

With the Internet's unprecedented growth and nations' reliance on computer networks, new cyber‐attacks are created every day as means for achieving financial gain, imposing political agendas, and developing cyberwarfare arsenals. Network security is thus acquiring increasing attention among researchers, practitioners, network architects, policy makers, and others. To defend organizations' networks from existing, foreseen, and future threats, intrusion detection systems (IDSs) are becoming a must. Existing surveys on anomaly‐based IDS (AIDS) focus on specific components such as detection mechanisms and lack many others. In contrast to existing surveys, this article covers the full scope needed by researchers and practitioners alike when studying AIDS. The scope ranges from the intrusion detection techniques to attacks forms and passing through the relevant attack features, most‐used datasets, challenges, and potential solutions. This article provides an exhaustive review of IDSs and discusses their requirements and performance metrics in deep. It presents a taxonomy of IDSs based on four criteria: information source, detection strategy, detection mode, and architecture. Then, in‐depth analysis and a comparison of network intrusion detection approaches based on anomaly detection techniques are given. The article also introduces a classification of computer network attacks, along with their different forms and the relevant network traffic features to detect them, as well as a summary of the popular datasets used by the researchers to evaluate the IDSs. Finally, the article highlights several research challenges and the possible solutions to deal with them.

show abstract

Deterministic memory-efficient string matching algorithms for intrusion detection

Abstract: Abstract

Cited by 309 publications

References 10 publications

Highly compressed multi-pattern string matching on the cell broadband engine

Highly compressed multi-pattern string matching on the cell broadband engine

Untitled

Anomaly‐based intrusion detection systems: The requirements, methods, measurements, and datasets

Contact Info

Product

Resources

About