NDLI: Efficient signature matching with multiple alphabet compression tables

Please wait, while we are loading the content...

Efficient signature matching with multiple alphabet compression tables

Relaxed authenticity for data aggregation in wireless sensor networks

Sybil proof anonymous reputation management

SMM rootkits: a new breed of OS independent malware

Detection of word shift steganography in PDF document

On the performance of a hybrid intrusion detection architecture for voice over IP systems

Attacking the Kad network

Unassailable sensor networks

PEAC: a probabilistic, efficient, and resilient authentication protocol for broadcast communications

A lightweight biometric signature scheme for user authentication over networks

Correlation-based load balancing for network intrusion detection and prevention systems

Source location privacy against laptop-class attacks in sensor networks

RepTrap: a novel attack on feedback-based reputation systems

On capturing malware dynamics in mobile power-law networks

Location privacy based on trusted computing and secure logging

LIDeA: a distributed lightweight intrusion detection architecture for sensor networks

Voice pharming attack and the trust of VoIP

Jamming Mitigation in Multi-Radio Wireless Networks: Reactive or Proactive?

Subjective logic based trust model for mobile ad hoc networks

rfidDOT: RFID delegation and ownership transfer made simple

Distributed flow detection over multi path sessions

Securely computing an approximate median in wireless sensor networks

Scalable and efficient provable data possession

Overbot: a botnet protocol based on Kademlia

Evaluating the utility of anonymized network traces for intrusion detection

Hiding "real" machine from attackers and malware with a minimal virtual machine monitor

A cross-layer dropping attack in video streaming over ad hoc networks

MISPAR: mitigating stealthy packet dropping in locally-monitored multi-hop wireless ad hoc networks

ARCMA: attack-resilient collaborative message authentication in wireless sensor networks

Parameterized access control: from design to prototype

An identity-based key infrastructure suitable for messaging and its application to e-mail

Containment of network worms via per-process rate-limiting

Attribute-based on-demand multicast group setup with membership anonymity

A heterogeneity-aware framework for group key management in wireless mesh networks

Towards more secure systems: how to combine expert evaluations

Efficient signature matching with multiple alphabet compression tables

Content Provider	ACM Digital Library
Author	Estan, Cristian Kong, Shijin Smith, Randy
Abstract	Signature matching is a performance critical operation in intrusion prevention systems. Modern systems express signatures as regular expressions and use Deterministic Finite Automata (DFAs) to efficiently match them against the input. In principle, DFAs can be combined so that all signatures can be examined in a single pass over the input. In practice, however, combining DFAs corresponding to intrusion prevention signatures results in memory requirements that far exceed feasible sizes. We observe for such signatures that distinct input symbols often have identical behavior in the DFA. In these cases, an Alphabet Compression Table (ACT) can be used to map such groups of symbols to a single symbol to reduce the memory requirements. In this paper, we explore the use of multiple alphabet compression tables as a lightweight method for reducing the memory requirements of DFAs. We evaluate this method on signature sets used in Cisco IPS and Snort. Compared to uncompressed DFAs, multiple ACTs achieve memory savings between a factor of 4 and a factor of 70 at the cost of an increase in run time that is typically between 35% and 85%. Compared to another recent compression technique, $D^{2}FAs,$ ACTs are between 2 and 3.5 times faster in software, and in some cases use less than one tenth of the memory used by $D^{2}FAs.$ Overall, for all signature sets and compression methods evaluated, multiple ACTs offer the best memory versus run-time trade-offs.
Starting Page	1
Ending Page	10
Page Count	10
File Format	PDF
ISBN	9781605582412
DOI	10.1145/1460877.1460879
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2008-09-22
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Regular expressions Alphabet compression Deep packet inspection Signature matching
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Multiple regular expressions matching for deep packet inspection (2007).

Algorithms to accelerate multiple regular expressions matching for deep packet inspection

Efficient signature matching with multiple alphabet compression tables.

Multi-byte Pattern Matching Using Stride-K DFA for High Speed Deep Packet Inspection

Fast and memory-efficient regular expression matching for deep packet inspection

Deflating the big bang: fast and scalable deep packet inspection with extended finite automata

Multiple Regular Expressions Matching for Deep Packet Inspection

Algorithms to accelerate multiple regular expressions matching for deep packet inspection

Algorithms to accelerate multiple regular expressions matching for deep packet inspection (2006)

Efficient signature matching with multiple alphabet compression tables

Similar Documents

Multiple regular expressions matching for deep packet inspection (2007).

Algorithms to accelerate multiple regular expressions matching for deep packet inspection

Efficient signature matching with multiple alphabet compression tables.

Multi-byte Pattern Matching Using Stride-K DFA for High Speed Deep Packet Inspection

Fast and memory-efficient regular expression matching for deep packet inspection

Deflating the big bang: fast and scalable deep packet inspection with extended finite automata

Multiple Regular Expressions Matching for Deep Packet Inspection

Algorithms to accelerate multiple regular expressions matching for deep packet inspection

Algorithms to accelerate multiple regular expressions matching for deep packet inspection (2006)

Efficient signature matching with multiple alphabet compression tables