Application of the Aho-Corasick algorithm to create a network intrusion detection system

Karimov, M.M.; Tashev, Komil; Rustamova, Sanobar

doi:10.1109/icisct50599.2020.9351435

Cited by 5 publications

(5 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The multipattern-matching algorithm includes AC and Commentz-Walter. The Commentz-Walter algorithm has the advantage of being faster than AC for a small number of patterns [84]. This study applied an entity recognition technique using the AC algorithm for future scalability, despite using a few multipatterns.…”

Section: Pattern Matchingmentioning

confidence: 99%

See 1 more Smart Citation

A Question-Answering Model Based on Knowledge Graphs for the General Provisions of Equipment Purchase Orders for Steel Plants Maintenance

Lee

Choi

2023

Electronics

View full text Add to dashboard Cite

Recently, equipment replacement and maintenance repair and operation (MRO) optimization have substantially increased owing to the aging and deterioration of industrial plants, such as steel-making factories in Korea. Therefore, plant owners are required to quickly review equipment supply contracts, i.e., purchase order (PO) documents, with suppliers and vendors. Currently, there is inconsistency in the time and quality required for the PO document review process by engineers, depending on their manual skills and practice. This study developed a general provisions question-answering model (GPQAM) by combining knowledge graph (KG) and question-answering (QA) techniques to search for semantically connected contract clauses through the definition of relationships between entities during the review of equipment purchase contracts. The PO documents analyzed in this case study were based on one steel-making company’s general provisions (GP). GPQAM is a machine learning (ML)-based model with two sub-models (i.e., KG and QA) that automatically generates the most relevant answers to semantic search questions through a cypher query statement in GP for the PO engineers. First, based on the developed GP lexicon and its classifying taxonomy to be stored in the Neo4j graph database (GDB), the KG sub-model finds the corresponding synonyms and consequently shows GP-related information in a graphic form. Second, the QA sub-model is a function to find and answer contract information within the KG and applies pattern-matching technology based on the Aho–Corasick (AC) algorithm. Third, nodes with the meaning most similar to the question are selected using similarity measurement if a response cannot be extracted through the pattern-matching process. Forty-five pilot test questions were created and applied to the GPQAM model evaluation. The F1 score was 82.8%, indicating that the unsupervised training methods developed in this study could be better applied to a semantic QA process in plant engineering documents, where sufficient training data are limited and bargained. An expert survey of PO practitioners confirmed that the semantic QA capability of GPQAM might be efficient and useful for their work. As the first case of applying KG technology to semantic QA for plant equipment PO contracts, this study might be a meaningful contribution to the steel plant industry and, therefore, extended to construction and engineering contract applications.

show abstract

Section: Pattern Matchingmentioning

confidence: 99%

“…The AC algorithm is a multipattern-matching algorithm that extends the Knuth-Morris-Pratt (KMP) algorithm [84]. A trie, an output link, and a failure link should be used to implement the AC algorithm.…”

Section: Pattern Matchingmentioning

confidence: 99%

A Question-Answering Model Based on Knowledge Graphs for the General Provisions of Equipment Purchase Orders for Steel Plants Maintenance

Lee

Choi

2023

Electronics

View full text Add to dashboard Cite

show abstract

“…e Aho-Corasick algorithm was first used for keyword extraction of protocols [38], followed by the frequent pattern FP-Growth algorithm to extract the format of messages [39]. Unlike the sequence comparison technique, the data mining technique takes all messages as input at once, which directly leads to a large computational cost for candidate selection.…”

Section: Related Workmentioning

confidence: 99%

From Unknown to Similar: Unknown Protocol Syntax Analysis for Network Flows in IoT

Wang

Hei

et al. 2021

Security and Communication Networks

View full text Add to dashboard Cite

Internet of Things (IoT) is the development and extension of computer, Internet, and mobile communication network and other related technologies, and in the new era of development, it increasingly shows its important role. To play the role of the Internet of Things, it is especially important to strengthen the network communication information security system construction, which is an important foundation for the Internet of Things business relying on Internet technology. Therefore, the communication protocol between IoT devices is a point that cannot be ignored, especially in recent years; the emergence of a large number of botnet and malicious communication has seriously threatened the communication security between connected devices. Therefore, it is necessary to identify these unknown protocols by reverse analysis. Although the development of protocol analysis technology has been quite mature, it is impossible to identify and analyze the unknown protocols of pure bitstreams with zero a priori knowledge using existing protocol analysis tools. In this paper, we make improvements to the existing protocol analysis algorithm, summarize and learn from the experience and knowledge of our predecessors, improve the algorithm ideas based on the Apriori algorithm idea, and perform feature string finding under the idea of composite features of CFI (Combined Frequent Items) algorithm. The advantages of existing algorithm ideas are combined together to finally propose a more efficient OFS (Optimal Feature Strings) algorithm with better performance in the face of bitstream protocol feature extraction problems.

show abstract

“…Multi-pattern matching algorithms include AC (Aho-Corasick automaton) algorithm [11][12], and improved AC-BM (Aho-Corasick Boyer-Moore) algorithm based on AC algorithm [13][14].…”

Section: Introductionmentioning

confidence: 99%

“…Literature [10] proposed a more efficient algorithm -BM algorithm, the core idea is to increase the pattern string jump distance by introducing good suffix rules and bad character rules. The AC automaton multi-pattern matching algorithm proposed in literature [11] and [12] achieves multiple pattern string matching with one input by constructing a dictionary tree, which is more efficient. However, the dictionary tree construction of the AC algorithm wastes a lot of memory and requires multiple backtracking to transfer to the effective successor state when there is a mismatch, which affects the performance of the algorithm.…”

Section: Introductionmentioning

confidence: 99%

Simulation Research on Fast Matching of Big Data Based on Spark

Song

Leng

et al. 2023

IEEE Access

View full text Add to dashboard Cite

To solve the problem of low efficiency in real-time processing and matching of CNAME records in massive DNS log data, a parallel AC automaton enhancement method based on Spark was proposed. The method is based on the Spark distributed cluster computing engine of Hadoop, which ensures the stability of massive DNS log data storage with high fault tolerance and 24-hour real-time processing. At the same time, the Spark distributed cluster uses the multi-thread parallel computing method combined with the improved AC automaton algorithm, which not only reduces the memory occupied by trie construction, but also improves the efficiency of rapid matching of CNAME records of massive DNS logs. Simulation results show that the proposed method can quickly match CNAME records of massive DNS log data. Compared with the original AC algorithm, the efficiency is significantly improved, and the time complexity and storage space are reduced.

show abstract

Application of the Aho-Corasick algorithm to create a network intrusion detection system

Cited by 5 publications

References 18 publications

A Question-Answering Model Based on Knowledge Graphs for the General Provisions of Equipment Purchase Orders for Steel Plants Maintenance

A Question-Answering Model Based on Knowledge Graphs for the General Provisions of Equipment Purchase Orders for Steel Plants Maintenance

From Unknown to Similar: Unknown Protocol Syntax Analysis for Network Flows in IoT

Simulation Research on Fast Matching of Big Data Based on Spark

Contact Info

Product

Resources

About