Abstract:As one of the key methods as well as a bottleneck for Network Intrusion Detection Systems (NIDSes) to detect and eliminate malicious traffic, pattern matching is increasingly gaining popularity while also faces threats from hackers' overloading attempts. The support of mixed case-sensitive and case-insensitive patterns, which is essential for NIDSes to detect possible attacks targeting different applications and operating systems, is currently a potential vulnerability since the widely used Convert-Search-Verify (CSV) approach encounters severe performance degradation in the worst-case scenarios. This paper firstly gives a thorough analysis on the reasons causing jams in the worst case, and then boosts up the performance by leveraging a novel mechanism named Convert-Search-incrementally-Verify (CSiV). CSiV differs from CSV in that it first merges possible case-sensitive matches to suspicious segments in the "Search" phase, and then leverages an Aho-Corasick like algorithm to verify them. The infeasibility of the simple Double Search (DS) approach is also explained by analyzing its low average-case throughput. Extensive experiments based on real pattern sets along with both collected and artificial traffic traces show that, the performance of the proposed approach outperforms the DS approach by a factor of 2 in the ordinary cases, and is better than the CSV approach up to 5 times under the worst-case scenario, indicating both its feasibility and robustness for a worst-case safe NIDS. © 2007 IEEE.

Scalable string matching framework enhanced by pattern clustering

Multi-Gigabit Rate Pattern-Matching Engine Using Grouping CAM/TCAM

A High Performance and Scalable Packet Pattern-Matching Architecture

A fast string matching algorithm for large-scale pattern sets

Towards High-Performance Pattern Matching on Multi-Core Network Processing Platforms

P4SC: A High Performance and Flexible Framework for Service Function Chain

P4CTM: Compressed Traffic Pattern Matching Based on Programmable Data Plane

Bolt: Scalable and Cost-Efficient Multistring Pattern Matching with Programmable Switches

Making Multi-String Pattern Matching Scalable and Cost-Efficient with Programmable Switching ASICs

Recursive Shift Indexing : A Fast Multi-Pattern String Matching Algorithm

Network Processor-Based High Performance String Matching

Optimizing multi-thread string matching for network processor based intrusion management system

Revisiting Multiple Pattern Matching Algorithms for Multi-Core Architecture

A robust approach for matching mixed case-sensitive and case-insensitive patterns

SCADIS: A Scalable Accelerator for Data-Intensive String Set Matching on FPGAs

Memory Efficient Algorithm and Architecture for Multi-Pattern Matching

Memory Efficient String Matching Algorithm for Network Intrusion Management System

Kangaroo: Accelerating String Matching by Running Multiple Collaborative Finite State Machines

Towards Fast Regular Expression Matching in Practice

Ultra-High Throughput String Matching for Deep Packet Inspection

Fast String Matching with Overlapped Substring Classifier in Deep Packet Inspection Systems