Abstract:Deep packet inspection at high speed has become extremely important due to its application in a wide range of network applications, such as network security and network monitoring. Network intrusion detection system (NIDS) uses a collection of signatures of known security threats and viruses to scan the payload of each packet. Signatures are often specified in the form of regular expressions (regex), called patterns, which are traditionally implemented as finite automata. Deterministic finite automata (DFA) is fast, but requires prohibitive amounts of memory which limits their practical use. Instead of matching an incoming packet with each individual regex in a ruleset, we match the packet with a fixed substring, called fingerprint, of a regex first. Fixed string matching is faster and consumes less energy than regex matching. The fact is that if a packet does not match with the fingerprint of a regex, it will not match the regex itself. So fingerprints can be used in a prefilter engine to filter out those packets and do not match any of the fingerprints of the regex in a rule set, which represents normal non-malicious traffic. This actually reduces the number of regex rules being matched, which results in increased throughput of the NIDS. We present a weight scheme to extract a good fingerprint from a regex. A good fingerprint is the one that not only indicates the regex uniquely, but also occurs as less as possible in the matching procedure. We demonstrate how to use fingerprints for efficient prefiltering by means of Bloom filters in practice.

A Scalable Bloom Filter Based Prefilter and Hardware-Oriented Predispatcher

A High Performance and Scalable Packet Pattern-Matching Architecture

Fast Packet Inspection Using State-Based Bloom Filter Engine

Fine-grained Parallel Multi-pattern Matching for Backbone Network NIDS

A High Speed Matching Algorithm of Unfixed-position Key Words Based on Bloom Filter

A Pareto Optimal Bloom Filter Family with Hash Adaptivity

Research and Design of a Novel Deep Packet Inspection Engine

Hash Adaptive Bloom Filter

NameFilter: Achieving Fast Name Lookup with Low Memory Cost Via Applying Two-Stage Bloom Filters

Ultra-Fast Bloom Filters Using SIMD Techniques

FeCBF: A Novel Sub-Optimal Cascaded Bloom Filter Structure Based on Feature Extraction

A Pipelined Hardware Architecture Of Deblocking Filter In H.264/Avc

Optimized hash lookup for bloom filter based packet routing

Multi-Dimensional Bloom Filter: Design and Evaluation.

Efficient Bloom Filter for Network Protocols Using AES Instruction Set

Low Computational Cost Bloom Filters

Extraction of Fingerprint from Regular Expression for Efficient Prefiltering

Reducing the number of Bloom filters

Scalable Double Filter Structure for Port Scan Detection.

TFD: A Multi-Pattern Matching Algorithm for Large-Scale URL Filtering

Hardware-based High-Performance String Lookup with Value Retrieval Using Extended Bloom Filter