High-Speed Matching of Vulnerability Signatures

Schear, Nabíl; Albrecht, David R.; Borisov, Nikita

doi:10.1007/978-3-540-87403-4_9

Cited by 15 publications

(16 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They are either hand optimized for better performance [5], or they are derived from an unoptimizable parsing model: recursive descent parsing with code execution [11], [12]. Hand optimized solutions suffer from a high production cost and are prone to errors [11], [12].…”

Section: B Limitations Of Prior Artmentioning

confidence: 99%

“…To illustrate one dimension where previous solutions struggle, we highlight the conflict between automated translation and optimization with line-speed extraction. One technique that can be exploited to achieve line-speed extraction is to ignore (not parse) unnecessary data [5]; we refer to this as selective parsing. Previous selective parsing work achieves higher throughput through hand pruning rather than automated translation and optimization [5], [13].…”

Section: B Limitations Of Prior Artmentioning

confidence: 99%

“…Full protocol parsing is not necessary for many applications. For example, Schear et al observed that full protocol parsing is not necessary for detecting vulnerability-based signatures because many protocol fields are not referenced in vulnerability signatures [5]. Spending scarce CPU and memory resources for parsing useless fields should be avoided for Intrusion Prevention Systems, which are resource constrained.…”

Section: Key Contributionsmentioning

confidence: 99%

“…Spending scarce CPU and memory resources for parsing useless fields should be avoided for Intrusion Prevention Systems, which are resource constrained. Based on such observations, Schear et al showed that hand-coded selective protocol parsers [5] can run 3 times faster than binpac. Parsing Generators: Recognizing the increasing demand for L7 parsers and the difficulty in developing robust protocol parsers, three L7 parser generators have been proposed: binpac [11], GAPA [12], and UltraPAC [13].…”

Section: Key Contributionsmentioning

confidence: 99%

See 3 more Smart Citations

FlowSifter: A counting automata approach to layer 7 field extraction for deep flow inspection

Meiners

Norige

Liu

et al. 2012

2012 Proceedings IEEE INFOCOM

View full text Add to dashboard Cite

Abstract-In this paper, we introduce FlowSifter, a systematic framework for online application protocol field extraction. FlowSifter introduces a new grammar model Counting Regular Grammars (CRG) and a corresponding automata model Counting Automata (CA). The CRG and CA models add counters with update functions and transition guards to regular grammars and finite state automata. These additions give CRGs and CAs the ability to parse and extract fields from context sensitive application protocols. These additions also facilitate fast and stackless approximate parsing of recursive structures. These new grammar models enable FlowSifter to generate optimized Layer 7 field extractors from simple extraction specifications. In our experiments, we compare FlowSifter against both BinPAC and UltraPAC, which are the freely available state of the art field extractors. Our experiments show that when compared to UltraPAC parsers, FlowSifter extractors run 84% faster and use 12% of the memory.

show abstract

Section: B Limitations Of Prior Artmentioning

confidence: 99%

Section: B Limitations Of Prior Artmentioning

confidence: 99%

Section: Key Contributionsmentioning

confidence: 99%

Section: Key Contributionsmentioning

confidence: 99%

See 2 more Smart Citations

FlowSifter: A counting automata approach to layer 7 field extraction for deep flow inspection

Meiners

Norige

Liu

et al. 2012

2012 Proceedings IEEE INFOCOM

View full text Add to dashboard Cite

show abstract

“…Although there have been recent approaches, such as in [237,252,273], to optimize IDPS resource consumption, we still need to deal with resource constraints and make the best use of an IDPS with available resource budgets.…”

Section: Motivationmentioning

confidence: 99%

Security configuration management in intrusion detection and prevention systems

Alsubhi

Alhazmi

Bouabdallah

et al. 2012

IJSN

View full text Add to dashboard Cite

Intrusion Detection and/or Prevention Systems (IDPS) represent an important line of defense against a variety of attacks that can compromise the security and proper functioning of an enterprise information system. IDPSs can be network or host-based and can collaborate in order to provide better detection of malicious traffic. Although several IDPS systems have been proposed, their appropriate configuration and control for effective detection/prevention of attacks and efficient resource consumption is still far from trivial.Another concern is related to the slowing down of system performance when maximum security is applied, hence the need to trade off between security enforcement levels and the performance and usability of an enterprise information system.In this dissertation, we present a security management framework for the configuration and control of the security enforcement mechanisms of an enterprise information system. The approach leverages the dynamic adaptation of security measures based on the assessment of system vulnerability and threat prediction, and provides several levels of attack containment. Furthermore, we study the impact of security enforcement levels on the performance and usability of an enterprise information system. In particular, we analyze the impact of an IDPS configuration on the resulting security of the network, and on the network performance. We also analyze the performance of the IDPS for different configurations and under different traffic characteristics. The analysis can then be used to predict the impact of a given security configuration on the prediction of the impact on network performance.iii Acknowledgements All praise is due to Allah who guided me through out this research and beyond.My deepest gratitude is to my advisor, Prof. Raouf Boutaba, for his guidance, support, patience, and encouragement. I have been amazingly fortunate to have an advisor who gave me the freedom to explore on my own, and at the same time the guidance to recover when my steps faltered. He was always available, professional, and friendly. I have learned from him to think differently, be optimistic, and be self motivated. This work would have not been done without his advice and valuable comments.

show abstract

Indices of Power in Optimal IDS Default Configuration: Theory and Examples

Zhu

Başar

2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Intrusion Detection Systems (IDSs) are becoming essential to protecting modern information infrastructures. The effectiveness of an IDS is directly related to the computational resources at its disposal. However, it is difficult to guarantee especially with an increasing demand of network capacity and rapid proliferation of attacks. On the other hand, modern intrusions often come as sequences of attacks to reach some predefined goals. It is therefore critical to identify the best default IDS configuration to attain the highest possible overall protection within a given resource budget. This paper proposes a game theory based solution to the problem of optimal signature-based IDS configuration under resource constraints. We apply the concepts of indices of power, namely, Shapley value and Banzhaf-Coleman index, from cooperative game theory to quantify the influence or contribution of libraries in an IDS with respect to given attack graphs. Such valuations take into consideration the knowledge on common attack graphs and experienced system attacks and are used to configure an IDS optimally at its default state by solving a knapsack optimization problem.

show abstract

High-Speed Matching of Vulnerability Signatures

Cited by 15 publications

References 17 publications

FlowSifter: A counting automata approach to layer 7 field extraction for deep flow inspection

FlowSifter: A counting automata approach to layer 7 field extraction for deep flow inspection

Security configuration management in intrusion detection and prevention systems

Indices of Power in Optimal IDS Default Configuration: Theory and Examples

Contact Info

Product

Resources

About