Sciweavers

Share
JSAC
2006

A Memory-Efficient Parallel String Matching Architecture for High-Speed Intrusion Detection

8 years 11 months ago
A Memory-Efficient Parallel String Matching Architecture for High-Speed Intrusion Detection
The ability to inspect both packet headers and payloads to identify attack signatures makes network intrusion detection system (NIDS) a promising approach to protect Internet systems. Since most of the known attacks can be represented with strings or combinations of multiple substrings, string matching is a key component, as well as the bottleneck in NIDS to address the requirement of constantly increasing capacity. We propose a memory-efficient multiple-character-approaching architecture consisting of multiple parallel deterministic finite automata (DFAs), called TDP-DFA. By employing efficient representations for the transition rules in each DFA, TDP-DFA significantly reduces the complexity. We also present a novel scheme to share the storage of transition rules among multiple DFAs, substantially decreasing the total storage cost, and avoiding the cost increase being proportional to the number of DFAs. We evaluate this design through theoretical analysis and comprehensive experiments...
Hongbin Lu, Kai Zheng, Bin Liu, Xin Zhang, Y. Liu
Added 13 Dec 2010
Updated 13 Dec 2010
Type Journal
Year 2006
Where JSAC
Authors Hongbin Lu, Kai Zheng, Bin Liu, Xin Zhang, Y. Liu
Comments (0)
books