Abstract:As one of the key methods as well as a bottleneck for Network Intrusion Detection Systems (NIDSes) to detect and eliminate malicious traffic, pattern matching is increasingly gaining popularity while also faces threats from hackers' overloading attempts. The support of mixed case-sensitive and case-insensitive patterns, which is essential for NIDSes to detect possible attacks targeting different applications and operating systems, is currently a potential vulnerability since the widely used Convert-Search-Verify (CSV) approach encounters severe performance degradation in the worst-case scenarios. This paper firstly gives a thorough analysis on the reasons causing jams in the worst case, and then boosts up the performance by leveraging a novel mechanism named Convert-Search-incrementally-Verify (CSiV). CSiV differs from CSV in that it first merges possible case-sensitive matches to suspicious segments in the "Search" phase, and then leverages an Aho-Corasick like algorithm to verify them. The infeasibility of the simple Double Search (DS) approach is also explained by analyzing its low average-case throughput. Extensive experiments based on real pattern sets along with both collected and artificial traffic traces show that, the performance of the proposed approach outperforms the DS approach by a factor of 2 in the ordinary cases, and is better than the CSV approach up to 5 times under the worst-case scenario, indicating both its feasibility and robustness for a worst-case safe NIDS. © 2007 IEEE.

Efficient long signature matching for gigabit intrusion detection sensors

Multi-Gigabit Rate Pattern-Matching Engine Using Grouping CAM/TCAM

Intrusion Detection And Simulation For High-Speed Networks

Variable Length Pattern Matching for Hardware Network Intrusion Detection System

A Memory-Efficient Parallel String Matching Architecture for High-Speed Intrusion Detection

P4CTM: Compressed Traffic Pattern Matching Based on Programmable Data Plane

NetShield : Matching with a Large Vulnerability Signature R uleset for High Performance Network Defense

Embedded network processor based parallel intrusion detection

Netshield: Massive Semantics-Based Vulnerability Signature Matching For High-Speed Networks

Study of Efficient Pattern Matching Algorithms in Intrusion Detection System

Scalable Nids Via Negative Pattern Matching and Exclusive Pattern Matching

Fine-grained Parallel Multi-pattern Matching for Backbone Network NIDS

Memory Efficient String Matching Algorithm for Network Intrusion Management System

Efficient Wu-Manber Pattern Matching Hardware for Intrusion and Malware Detection

An Efficient Security System for Mobile Data Monitoring.

Fast Dynamic Pattern Matching for Deep Packet Inspection

A Multiple Regular Expressions Matching Architecture For Network Intrusion Detection System

A Digest and Pattern Matching-Based Intrusion Detection Engine

A robust approach for matching mixed case-sensitive and case-insensitive patterns

A Fast Multi-pattern Matching Algorithm for Deep Packet Inspection on a Network Processor

Multi-core Processors Based Network Intrusion Detection Method.