TAILIEUCHUNG - Efficient Pattern Matching Algorithm for Memory Architecture

Network intrusion detection system is used to inspect packet contents against thousands of predefined malicious or suspicious patterns. Because traditional software alone pattern matching approaches can no longer meet the high throughput of today’s networking, many hardware approaches are proposed to accelerate pattern matching. | This article has been accepted for inclusion in a future issue of this journal. Content is final as presented with the exception of pagination. 1 IEEE TRANSACTIONS ON VERY LARGE SCALE INTEGRATION VLSI SYSTEMS Efficient Pattern Matching Algorithm for Memory Architecture Cheng-Hung Lin Member IEEE and Shih-Chieh Chang Member IEEE Abstract Network intrusion detection system is used to inspect packet contents against thousands of predefined malicious or suspicious patterns. Because traditional software alone pattern matching approaches can no longer meet the high throughput of today s networking many hardware approaches are proposed to accelerate pattern matching. Among hardware approaches memory-based architecture has attracted a lot of attention because of its easy reconfigurability and scalability. In order to accommodate the increasing number of attack patterns and meet the throughput requirement of networks a successful network intrusion detection system must have a memory-efficient pattern-matching algorithm and hardware design. In this paper we propose a memory-efficient pattern-matching algorithm which can significantly reduce the memory requirement. For Snort rule sets the new algorithm achieves 21 of memory reduction compared with the traditional Aho-Corasick algorithm. In addition we can gain 24 of memory reduction by integrating our approach to the bit-split algorithm which is the state-of-the-art memory-based approach. Index Terms Aho-Corasick AC algorithm finite automata pattern matching. I. Introduction The main purpose of a signature-based network intrusion detection system is to prevent malicious network attacks by identifying known attack patterns. Due to the increasing complexity of network traffic and the growing number of attacks an intrusion detection system must be efficient flexible and scalable. The primary function of an intrusion detection system is to perform matching of attack string patterns. Because string matching is the most computative

TỪ KHÓA LIÊN QUAN
TAILIEUCHUNG - Chia sẻ tài liệu không giới hạn
Địa chỉ : 444 Hoang Hoa Tham, Hanoi, Viet Nam
Website : tailieuchung.com
Email : tailieuchung20@gmail.com
Tailieuchung.com là thư viện tài liệu trực tuyến, nơi chia sẽ trao đổi hàng triệu tài liệu như luận văn đồ án, sách, giáo trình, đề thi.
Chúng tôi không chịu trách nhiệm liên quan đến các vấn đề bản quyền nội dung tài liệu được thành viên tự nguyện đăng tải lên, nếu phát hiện thấy tài liệu xấu hoặc tài liệu có bản quyền xin hãy email cho chúng tôi.
Đã phát hiện trình chặn quảng cáo AdBlock
Trang web này phụ thuộc vào doanh thu từ số lần hiển thị quảng cáo để tồn tại. Vui lòng tắt trình chặn quảng cáo của bạn hoặc tạm dừng tính năng chặn quảng cáo cho trang web này.