Design and evaluation of parallel string matching algorithms for network intrusion detection systems

Authors:
Tyrone Tai-On Kwok;Yu-Kwong Kwok
Affiliations:
Department of Electrical and Electronic Engineering, The University of Hong Kong, Hong Kong;Department of Electrical and Electronic Engineering, The University of Hong Kong, Hong Kong
Venue:
NPC'07 Proceedings of the 2007 IFIP international conference on Network and parallel computing
Year:
2007

Citing 8
Cited 0

Introduction to algorithms

Introduction to algorithms
A fast string searching algorithm

Communications of the ACM
Efficient string matching: an aid to bibliographic search

Communications of the ACM
Fast Content-Based Packet Handling for Intrusion Detection

Fast Content-Based Packet Handling for Intrusion Detection
Dynamics, emergent computation, and evolution in cellular automata

Dynamics, emergent computation, and evolution in cellular automata
Time and area efficient pattern matching on FPGAs

FPGA '04 Proceedings of the 2004 ACM/SIGDA 12th international symposium on Field programmable gate arrays
Theory of Self-Reproducing Automata

Theory of Self-Reproducing Automata
The Problem with Threads

Computer

Quantified Score

Hi-index	0.00

Visualization

Abstract

Abstract. Network security is very important for Internet-connected hosts because of the widespread of worms, viruses, DoS attacks, etc. As a result, a network intrusion detection system (NIDS) is typically needed to detect network attacks by packet inspection. For an NIDS system, string matching is the computation-intensive task and hence the performance bottleneck, since every byte of the payload of packets must be checked against numerous predefined signature strings, which may occur arbitrarily in the payload. In this paper, we present the design and evaluation of parallel string matching algorithms targeting hardware implementation on FPGAs and software implementation on multi-core processors. Experimental results show that, on a multi-processor system, the multi-threaded implementation of the proposed parallel string matching algorithm can reduce string matching time by more than 40%.