Using String Matching for Deep Packet Inspection

Lin, Po-Ching; Lin, Ying‐Dar; Lee, Tsern-Huei; Lai, Yuan‐Cheng

doi:10.1109/mc.2008.138

Cited by 90 publications

(46 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…To update them, the chip must be redesigned, which usually requires high production cost. Mitra et al [14], [17] implemented an NFA-based regular-expression engine on an SGI Altix 4700 workstation with FPGA support. The throughput of the NFA improved noticeably as a result of their study, whereas the compact memory requirement was maintained.…”

Section: Related Workmentioning

confidence: 99%

A Lightweight Software Model for Signature-Based Application-Level Traffic Classification System

Park

Yoon

Won

et al. 2014

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYInternet traffic classification is an essential step for stable service provision. The payload signature classifier is considered a reliable method for Internet traffic classification but is prohibitively computationally expensive for real-time handling of large amounts of traffic on high-speed networks. In this paper, we describe several design techniques to minimize the search space of traffic classification and improve the processing speed of the payload signature classifier. Our suggestions are (1) selective matching algorithms based on signature type, (2) signature reorganization using hierarchical structure and traffic locality, and (3) early packet sampling in flow. Each can be applied individually, or in any combination in sequence. The feasibility of our selections is proved via experimental evaluation on traffic traces of our campus and a commercial ISP. We observe 2 to 5 times improvement in processing speed against the untuned classification system and Snort Engine, while maintaining the same level of accuracy.

show abstract

Section: Related Workmentioning

confidence: 99%

A Lightweight Software Model for Signature-Based Application-Level Traffic Classification System

Park

Yoon

Won

et al. 2014

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

show abstract

“…Many research studies have focused on accelerating the pattern-matching process for high-speed IDPSs (e.g., [188,202]). The approaches to acceleration involve designing efficient pattern-matching algorithms [33,217] , leveraging hardware implementation [40,179,193,202], and program parallelization [222].…”

Section: Detection Methodologiesmentioning

confidence: 99%

Security configuration management in intrusion detection and prevention systems

Alsubhi

Alhazmi

Bouabdallah

et al. 2012

IJSN

View full text Add to dashboard Cite

Intrusion Detection and/or Prevention Systems (IDPS) represent an important line of defense against a variety of attacks that can compromise the security and proper functioning of an enterprise information system. IDPSs can be network or host-based and can collaborate in order to provide better detection of malicious traffic. Although several IDPS systems have been proposed, their appropriate configuration and control for effective detection/prevention of attacks and efficient resource consumption is still far from trivial.Another concern is related to the slowing down of system performance when maximum security is applied, hence the need to trade off between security enforcement levels and the performance and usability of an enterprise information system.In this dissertation, we present a security management framework for the configuration and control of the security enforcement mechanisms of an enterprise information system. The approach leverages the dynamic adaptation of security measures based on the assessment of system vulnerability and threat prediction, and provides several levels of attack containment. Furthermore, we study the impact of security enforcement levels on the performance and usability of an enterprise information system. In particular, we analyze the impact of an IDPS configuration on the resulting security of the network, and on the network performance. We also analyze the performance of the IDPS for different configurations and under different traffic characteristics. The analysis can then be used to predict the impact of a given security configuration on the prediction of the impact on network performance.iii Acknowledgements All praise is due to Allah who guided me through out this research and beyond.My deepest gratitude is to my advisor, Prof. Raouf Boutaba, for his guidance, support, patience, and encouragement. I have been amazingly fortunate to have an advisor who gave me the freedom to explore on my own, and at the same time the guidance to recover when my steps faltered. He was always available, professional, and friendly. I have learned from him to think differently, be optimistic, and be self motivated. This work would have not been done without his advice and valuable comments.

show abstract

“…There are two specific implementations of AC Algorithm: Deterministic Finite Automaton (DFA) and Nondeterministic Finite Automaton (NFA). Because of the deterministic linear time complexity O(N) and fixed size of state transitions table, string matching based on the DFA model is desirable [6]. Although AC Algorithm has a time complexity of O(N), where N is the sum of the matching text and all of the pattern set, it requires a large memory to store the state transition table, which is a limitation to memory space.…”

Section: Aho-corasick Algorithm and Optimizationmentioning

confidence: 99%