NIS06-4: A Non-Computational Intensive Pre-filter for Pattern Matching in Network Intrusion Detection Systems

Huang, Nen-Fu; Chen, Jianlin; Hun, Hsien-Wei; Chu, Yen-Ming; Shih, Ming‐Chang; Tzang, Yih-Jou

doi:10.1109/glocom.2006.294

Cited by 3 publications

(2 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It makes extremely small data structures stored in embedded on-chip memory for fast packet filtration, and thus accelerates string matching. Such filtration method is also adopted by [10] for accelerating string matching with low-computation software solution.…”

Section: Cmentioning

confidence: 99%

A Novel Algorithm and Architecture for High Speed Pattern Matching in Resource-Limited Silicon Solution

Huang

Chu

Tsai

et al. 2007

2007 IEEE International Conference on Communications

View full text Add to dashboard Cite

Network Intrusion Detection Systems (NIDS) are more and more important for identifying and preventing the malicious attacks over the network. This paper proposes a novel cost-effective high speed pattern matching algorithm (named MSH) for NIDS. By applying the characteristics of magic states, a new observation from the deterministic finite state automata (DFA), the proposed MSH constructs a tiny data structure which can be stored into the on-chip memory of modern cost effective FPGA. Prototype and experimental results show the overall efficiency of the proposed MSH is at least 7 times faster than that of the baseline model. The MSH enables the design of cost effective FPGA-based accelerator to furnish over 1Gbps throughput. It can also be scaled to multi-gigabit and realized on various silicon implementations.

show abstract

Section: Cmentioning

confidence: 99%

A Novel Algorithm and Architecture for High Speed Pattern Matching in Resource-Limited Silicon Solution

Huang

Chu

Tsai

et al. 2007

2007 IEEE International Conference on Communications

View full text Add to dashboard Cite

show abstract

“…For the demand of performing layer-7 packet content inspection on network appliances, various studies have been proposed and implemented-search filter [8] [9], reconfigurable silicon hardware [10], and TCAM-based method [11]. In this paper, a novel scheme, "String Matching as Longest Prefix Matching" (SM as LPM), is presented for applying the existing layer-3 LPM techniques of IP address lookup to the layer-7 packet content inspection.…”

Section: Introductionmentioning

confidence: 99%

Performing Packet Content Inspection by Longest Prefix Matching Technology

Huang

Chu

Wu³

et al. 2007

IEEE GLOBECOM 2007-2007 IEEE Global Telecommunications Conference

Self Cite

View full text Add to dashboard Cite

This article presents a novel mechanism to perform packet content inspection by longest prefix matching (LPM) technology. It is done by transforming the automaton-based state table lookup problem into the famous LPM table lookup problem. Two key features, symbol-wise prefix and magic state are observed on the state table to make it possible to utilize IP lookup techniques for string matching. The proposed mechanism is verified to be effective through Lulea algorithm. Also, the practicability is evaluated by employing realistic attack signatures and traffic traces. The experimental results indicate that a state table constructed from the Snort 2.4 patterns can be converted into a prefix table that requires only 2.5% of the memory utilized in the original state table. Compared with the state-of-the-art researches, the proposed scheme has more than 3 times of efficiency, achieving a better balance between required memory size and throughput rate.

show abstract

A software-based string matching algorithm for resource-restricted network system

et al. 2008

View full text Add to dashboard Cite

NIS06-4: A Non-Computational Intensive Pre-filter for Pattern Matching in Network Intrusion Detection Systems

Cited by 3 publications

References 9 publications

A Novel Algorithm and Architecture for High Speed Pattern Matching in Resource-Limited Silicon Solution

A Novel Algorithm and Architecture for High Speed Pattern Matching in Resource-Limited Silicon Solution

Performing Packet Content Inspection by Longest Prefix Matching Technology

A software-based string matching algorithm for resource-restricted network system

Contact Info

Product

Resources

About