Predictive pattern matching for scalable network intrusion detection

Authors:
Lucas Vespa;Mini Mathew;Ning Weng
Affiliations:
Department of Electrical and Computer Engineering, Southern Illinois University Carbondale, Carbondale, IL;Department of Electrical and Computer Engineering, Southern Illinois University Carbondale, Carbondale, IL;Department of Electrical and Computer Engineering, Southern Illinois University Carbondale, Carbondale, IL
Venue:
ICICS'09 Proceedings of the 11th international conference on Information and Communications Security
Year:
2009

Citing 8
Cited 0

An Intrusion-Detection Model

IEEE Transactions on Software Engineering - Special issue on computer security and privacy
Efficient string matching: an aid to bibliographic search

Communications of the ACM
A Methodology for Synthesis of Efficient Intrusion Detection Systems on FPGAs

FCCM '04 Proceedings of the 12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines
Snort - Lightweight Intrusion Detection for Networks

LISA '99 Proceedings of the 13th USENIX conference on System administration
A Scalable Architecture For High-Throughput Regular-Expression Pattern Matching

Proceedings of the 33rd annual international symposium on Computer Architecture
An improved algorithm to accelerate regular expression evaluation

Proceedings of the 3rd ACM/IEEE Symposium on Architecture for networking and communications systems
Implementing high-speed string matching hardware for network intrusion detection systems

Proceedings of the 16th international ACM/SIGDA symposium on Field programmable gate arrays
Self-addressable memory-based FSM: a scalable intrusion detection engine

IEEE Network: The Magazine of Global Internetworking - Special issue title on recent developments in network intrusion detection

Quantified Score

Hi-index	0.00

Visualization

Abstract

Signature-based network intrusion detection requires fast and reconfigurable pattern matching for deep packet inspection. This paper presents a novel pattern matching engine, which exploits a memory-based programmable state machine to achieve deterministic processing rates that are independent of packet and pattern characteristics. Our engine is a portable predictive pattern matching finite state machine (P3FSM), which combines the properties of hardware-based systems with the portability and programmability of software. Specifically we introduce two methods, “Character Aware” and “SDFA”, for encoding predictive state codes which can forecast the next states of our FSM. The result is software based pattern matching which is fast, reconfigurable, memory-efficient and portable.