P3FSM: Portable Predictive Pattern Matching Finite State Machine

Vespa, Lucas; Mathew, Mini; Weng, Ning

doi:10.1109/asap.2009.16

Cited by 10 publications

(3 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Assuming a deterministic multi pattern search based on Aho-Corasick (Aho and Corasick, 1975) or DFA (Vespa et al, 2009;Brodie et al, 2006), the processing overhead due to deep packet inspection is a constant delay per packet byte. r and d bi are controllable input parameters for our testbed and they depend on both the packet size and also the technology used for content fi ltering.…”

Section: Processing Delaymentioning

confidence: 99%

Lightweight testbed for evaluating worm containment systems

Vespa

Chakrovorty

Weng

2012

IJSN

Self Cite

View full text Add to dashboard Cite

Hazardous worms can compromise hundreds of thousands of hosts in just hours. Mitigating these worm threats requires fast and effective strategies for containment and is a diffi cult task. Many containment systems have been proposed including anomaly detection, address blacklisting and signature-based content fi ltering. Meanwhile recently developed worm models enable us to develop a testbed to quickly evaluate the effi ciency of defense mechanisms. Existing testbeds either require a great deal of hardware resources, or do not account for network performance impact due to containment methods. In this paper, we present a testbed which utilizes software agents to allow large scale simulation while maintaining individual host functionality. Varying containment schemes and strategies have been evaluated using this testbed in terms of number of infected hosts and performance impacts. Our results indicate that a dynamic containment system achieves better performance and security. We believe our testbed is an effective tool to explore and evaluate varying worm containment systems.

show abstract

Section: Processing Delaymentioning

confidence: 99%

Lightweight testbed for evaluating worm containment systems

Vespa

Chakrovorty

Weng

2012

IJSN

Self Cite

View full text Add to dashboard Cite

show abstract

“…Content labels help to reduce default transaction to achieve higher throughput and scalability in number of rules as compared to DFA. Portable predictive Pattern Matching Finite State Machine (P3FSM) [55], yet another version of DFA proposed by Vespa et al which is a software based FSM but able to achieve throughput at par to hardware based pattern matching with SDFA and CA technique. SDFA(Split-DFA) eliminates redundant transactions, then partitions the DFA into multiple blocks called primary and secondary blocks and CA(character aware) which takes account of distribution of characters which helps FSM quickly isolate the correct next state based on incoming packet characters.…”

Section: Finite State Machinementioning

confidence: 99%

Software Based Implementation Methodologies for Deep Packet Inspection

Chaudhary¹,

Sardana²

2011

2011 International Conference on Information Science and Applications

View full text Add to dashboard Cite

Deep Packet Inspection plays an important role for providing secure and congestion free network. It determines whether incoming traffic matches a database of signatures up to payload level, where each signature represents an attack, vulnerability, Virus, worm and even type of traffic. Other techniques like IDS/IPS etc uses only packet header information for decision making, while DPI is considers whole packet including payload for matching which provides better surveillance then other techniques. The problems that DPI system faces is low packet throughput, high memory requirement, latency and low accuracy at line speed of 10GbE/OC192.This paper reviews different software based approaches for efficient implementation of Deep Packet Inspection. A comparative study has been performed for these approaches on the basis of packet throughput and memory requirements. This paper is an attempt to exhaustively review existing techniques to addresses the probable research gaps. It then suggests a novel software based implementation of DPI to overcome the identified research gaps.

show abstract

“…Deterministic Finite Automata (DFA) [Aho and Corasick 1975;Brodie et al 2006;Soewito et al 2009;Vespa et al 2009] is able to match multiple strings simultaneously, in worst-case time linear to the size of a packet. Unfortunately, DFA are difficult to implement effectively as they possess many characteristics that make them spatially complex and memory inefficient [Becchi and Crowley 2007;Kumar et al 2006;van Lunteren 2006;Smith et al 2008b;Vespa and Weng 2009b].…”

Section: Introductionmentioning

confidence: 99%

Deterministic finite automata characterization and optimization for scalable pattern matching

Vespa

Weng

2011

ACM Trans. Archit. Code Optim.

Self Cite

View full text Add to dashboard Cite

Memory-based Deterministic Finite Automata (DFA) are ideal for pattern matching in network intrusion detection systems due to their deterministic performance and ease of update of new patterns, however severe DFA memory requirements make it impractical to implement thousands of patterns. This article aims to understand the basic relationship between DFA characteristics and memory requirements, and to design a practical memory-based pattern matching engine. We present a methodology that consists of theoretical DFA characterization, encoding optimization, and implementation architecture. Results show the validity of the characterization metrics, effectiveness of the encoding techniques, and efficiency of the memory-based pattern engines.

show abstract

P3FSM: Portable Predictive Pattern Matching Finite State Machine

Cited by 10 publications

References 7 publications

Lightweight testbed for evaluating worm containment systems

Lightweight testbed for evaluating worm containment systems

Software Based Implementation Methodologies for Deep Packet Inspection

Deterministic finite automata characterization and optimization for scalable pattern matching

Contact Info

Product

Resources

About