Highly compressed Aho-Corasick automata for efficient intrusion detection

Abstract

We develop a method to compress the unoptimized Aho-Corasick automaton that is used widely in intrusion detection systems. Our method uses bitmaps with multiple levels of summaries as well as aggressive path compaction. By using multiple levels of summaries, we are able to determine a popcount with as few as 1 addition. On Snort string databases, our compressed automata take 24% to 31 % less memory than taken by the compressed automata of 'nIck et al. [23]. and the number of additions required to compute popcounts is reduced by about 90%.

Lightweight C&C based botnet detection using Aho-Corasick NFA

“…For this purpose the Aho-Corasick algorithm [10] is employed because it is a multi-pattern matching algorithm and it is scalable too [15]. Given a set of bot commands, as the pattern to search for, in the arriving IRC packets, the algorithm constructs a non-deterministic finite automation (NFA), which is employed to match all patterns at once.…”

An Assessment of Algorithms for Deriving Failure Deterministic Finite Automata

“…As a result, DFAs are extensively used in many practical string processing applications that relate to the regular languages. These include searching through natural language texts (Drozdek, 2008, p. 702), network intrusion detection (Roesch, 1999;Zha & Sahni, 2008), lexical analysis (Aho, Lam, Sethi, & Ullman, 2006;Lesk & Schmidt, 1990) and biological sequence data processing (Roy & Aluru, 2014).…”