Architectures for Bit-Split String Scanning in Intrusion Detection

Authors:
Lin Tan;Timothy Sherwood
Affiliations:
University of Illinois, Urbana-Champaign;University of California, Santa Barbara
Venue:
IEEE Micro
Year:
2006

Citing 13
Cited 8

Smart Memories: a modular reconfigurable architecture

Proceedings of the 27th annual international symposium on Computer architecture
A fast string searching algorithm

Communications of the ACM
Efficient string matching: an aid to bibliographic search

Communications of the ACM
Specialized Hardware for Deep Network Packet Filtering

FPL '02 Proceedings of the Reconfigurable Computing Is Going Mainstream, 12th International Conference on Field-Programmable Logic and Applications
Time and area efficient pattern matching on FPGAs

FPGA '04 Proceedings of the 2004 ACM/SIGDA 12th international symposium on Field programmable gate arrays
Deep Packet Filter with Dedicated Logic and Read Only Memories

FCCM '04 Proceedings of the 12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines
A Methodology for Synthesis of Efficient Intrusion Detection Systems on FPGAs

FCCM '04 Proceedings of the 12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines
Pre-Decoded CAMs for Efficient and High-Speed NIDS Pattern Matching

FCCM '04 Proceedings of the 12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines
Snort - Lightweight Intrusion Detection for Networks

LISA '99 Proceedings of the 13th USENIX conference on System administration
Configurable string matching hardware for speeding up intrusion detection

ACM SIGARCH Computer Architecture News - Special issue: Workshop on architectural support for security and anti-virus (WASSA)
A High Throughput String Matching Architecture for Intrusion Detection and Prevention

Proceedings of the 32nd annual international symposium on Computer Architecture
Denial of service via algorithmic complexity attacks

SSYM'03 Proceedings of the 12th conference on USENIX Security Symposium - Volume 12
Deep Packet Inspection using Parallel Bloom Filters

IEEE Micro

Efficient memory utilization on network processors for deep packet inspection

Proceedings of the 2006 ACM/IEEE symposium on Architecture for networking and communications systems
Compact state machines for high performance pattern matching

Proceedings of the 44th annual Design Automation Conference
DPICO: a high speed deep packet inspection engine using compact finite automata

Proceedings of the 3rd ACM/IEEE Symposium on Architecture for networking and communications systems
A NetFlow based flow analysis and monitoring system in enterprise networks

Computer Networks: The International Journal of Computer and Telecommunications Networking
Realizing a sub-linear time string-matching algorithm with a hardware accelerator using bloom filters

IEEE Transactions on Very Large Scale Integration (VLSI) Systems
CompactDFA: generic state machine compression for scalable pattern matching

INFOCOM'10 Proceedings of the 29th conference on Information communications
Efficient processing of multi-connection compressed web traffic

NETWORKING'11 Proceedings of the 10th international IFIP TC 6 conference on Networking - Volume Part I
Space efficient deep packet inspection of compressed web traffic

Computer Communications

Quantified Score

Hi-index	0.00

Visualization

Abstract

String matching is a critical element of modern intrusion detection systems because it lets a system make decisions based not just on headers, but actual content flowing through the network. Through careful codesign and optimization of an architecture with a new string matching algorithm, the authors show it is possible to build a system that is almost 12 times more efficient than the currently best known approaches.