NIS04-6: A Time- and Memory- Efficient String Matching Algorithm for Intrusion Detection Systems

Abstract

Intrusion Detection Systems (IDSs) are known as useful tools for identifying malicious attempts over the network. The most essential part to an IDS is the searching engine that inspects every packet through the network. To strictly defend the protectorate, an IDS must be able to inspect packets at line rate and also provide guaranteed performance even under heavy attacks. Therefore, in this paper we propose an efficient string matching algorithm (named ACM) with compact memory as well as high worst-case performance. Using a magic number heuristic based on the Chinese Remainder Theorem, the proposed ACM significantly reduces the memory requirement without bringing complex processes. Furthermore, the latency of off-chip memory references is drastically reduced. The proposed ACM can be easily implemented in hardware and software. As a result, ACM enables cost-effective and efficient IDSs.

In-Depth Packet Inspection Using a Hierarchical Pattern Matching Algorithm

“…Using a compressed structure, Tuck et al proposed the AC algorithm with memory compression (AC-C), a modification of AC, and reduced the required memory to about 2 percent of AC [8]. ACM applied a magic number derived from the Chinese Remainder Theorem to AC [14]. ACM reduced the required memory space and computation complexity, thus improving the worst-case performance.…”

Incremental RotBoost algorithm: An application for spam filtering

“…In many practical applications, there are some limitations on using training data because of the following reasons: 1) producing training data is a time consuming and expensive task, 2) a limitation on memory exists for using all training data at the same time, and 3) not all training data are available at training time. For example, in Intrusion Detection Systems, not all training data are available at the same time and consideration of all data for training requires a huge amount of memory, which increases the training time considerably [1]. Similarly, in the classification of stream data, it is not possible to store all the data for using as training data [2].…”