Fast multipattern search algorithms for intrusion detection

Kuri, J.; Navarro, Gonzalo

doi:10.1109/spire.2000.878193

Cited by 7 publications

(8 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In other words, we want to find all minimal length text substrings t, such that id(P, t) ≤ k, where id(P, t) is the minimum number of symbols inserted to P , to convert it to t. It follows that if P is a subsequence of t, then id(P, t) = |t| − |P | = |t| − m, and ∞ otherwise, and that m ≤ |t| ≤ m + k if t matches P with at most k insertions. This matching model has important applications in intrusion detection [9]. The problem can be solved using dynamic programming [9].…”

Section: Intrusion Detection and Episode Matchingmentioning

confidence: 99%

“…This matching model has important applications in intrusion detection [9]. The problem can be solved using dynamic programming [9]. We define a vector C of counters: …”

Section: Intrusion Detection and Episode Matchingmentioning

confidence: 99%

“…It was then shown by Kuri et al [9] how to compute C i using bit-parallelism, which resulted in an O(n m log(k)/w ) worst case time algorithm. We briefly present the Kuri et al algorithm as this is the starting point of our solution.…”

Section: Intrusion Detection and Episode Matchingmentioning

confidence: 99%

“…but the real algorithm is somewhat more complicated due to handling the counter overflows in the usual way, see [9] It might seem that nested counters could be used for this algorithm just as easily as with Shift-Add, but there is actually a new problem. As seen in Eq.…”

Section: Intrusion Detection and Episode Matchingmentioning

confidence: 99%

See 3 more Smart Citations

Nested Counters in Bit-Parallel String Matching

Fredriksson

Grabowski

2009

Language and Automata Theory and Applications

View full text Add to dashboard Cite

Abstract. Many algorithms, e.g. in the field of string matching, are based on handling many counters, which can be performed in parallel, even on a sequential machine, using bit-parallelism. The recently presented technique of nested counters (Matryoshka counters) [1] is to handle small counters most of the time, and refer to larger counters periodically, when the small counters may get full, to prevent overflow. In this work, we present several non-trivial applications of Matryoshka counters in string matching algorithms, improving their worst-or average-case time complexities. The set of problems comprises (δ, α)-matching, matching with k insertions, episode matching, and matching under Levenshtein distance.

show abstract

Section: Intrusion Detection and Episode Matchingmentioning

confidence: 99%

“…This matching model has important applications in intrusion detection [9]. The problem can be solved using dynamic programming [9]. We define a vector C of counters: …”

Section: Intrusion Detection and Episode Matchingmentioning

confidence: 99%

Section: Intrusion Detection and Episode Matchingmentioning

confidence: 99%

Section: Intrusion Detection and Episode Matchingmentioning

confidence: 99%

See 2 more Smart Citations

Nested Counters in Bit-Parallel String Matching

Fredriksson

Grabowski

2009

Language and Automata Theory and Applications

View full text Add to dashboard Cite

show abstract

“…In such a way, up to a tolerance level determined in advance, the IDS would be capable of detecting several variants of the same attack by keeping just one attack signature in its database (see for example [1]). …”

Section: Introductionmentioning

confidence: 99%

A Constrained Approximate Search Scenario for Intrusion Detection in Hosts and Networks

Petrović

2016

Proceedings of the International Scientific Conference - Sinteza 2016

View full text Add to dashboard Cite

Abstract:It is well known that most new attacks against computer systems and networks originate from the old ones. Namely, it is possible to change the old attack patterns in such a way that the modified patterns affect approximately the same targets on the victim system and pass undetected by signature-based Intrusion Detection Systems (IDS) or other detection tools. In this paper, we consider a scenario where an old attack pattern is changed by means of an automatic tool. The structure of changes must be kept under control in order for the attack to remain effective. For example, the number of changed symbols in an automatically crafted string in the attack pattern must be limited. Otherwise, this string would not affect the victim system in the same way as in the original attack. Under such an assumption, we describe the requirements for a search algorithm implemented in the detection tool (for example, an IDS) that would be capable of detecting the changes in the old attack signature. We present the basic structure of a generic search algorithm of this kind, describe some application scenarios and discuss the effectiveness of the algorithm under these scenarios.

show abstract

Approximate Search in Digital Forensics

Petrović

2017

Computer and Network Security Essentials

View full text Add to dashboard Cite

Fast multipattern search algorithms for intrusion detection

Cited by 7 publications

References 17 publications

Nested Counters in Bit-Parallel String Matching

Nested Counters in Bit-Parallel String Matching

A Constrained Approximate Search Scenario for Intrusion Detection in Hosts and Networks

Approximate Search in Digital Forensics

Contact Info

Product

Resources

About