Loading...
Please wait, while we are loading the content...
A High Throughput String Matching Architecture for Intrusion Detection and Prevention
| Content Provider | Semantic Scholar |
|---|---|
| Author | Sherwood, Lin Tan Timothy |
| Abstract | NetworkIntrusionDetectionandPreventionSystemshave emerged as oneof the mosteffectivewaysof providing security to thoseconnectedto thenetwork,andat theheartof almostevery modernintrusion detectionsystemis a string matching algorithm. Stringmatching is oneof themostcritical elementsbecauseit allows for the systemto make decisionsbasednot just on the header s, but the actual content owing through the network. Unfortunately, checking every byteof every packet to seeif it matchesoneof a setof ten thousandstringsbecomesa computationallyintensivetaskas networkspeedsgrow into the tens,andeventuallyhundreds, of gigabits/second. To keepup with thesespeedsa specializeddevice is required, one that can maintain tight boundson worst case performance, that canbeupdatedwith new ruleswithout interrupting operation, and one that is ef cient enoughthat it couldbe includedonchip with existingnetworkchipsor even into wirelessdevices. We havedevelopedan approach that relieson a specialpurposearchitecture that executesnovel stringmatchingalgorithmsspeciallyoptimizedfor implementation in our design.Weshowhowtheproblemcanbesolved by converting the large databaseof strings into many tiny statemachines,each of which searchesfor a portion of the rulesanda portionof thebitsof each rule. Throughthecareful co-designandoptimizationof our architecturewith a new stringmatchingalgorithmweshowthat it is possibleto build a systemthat is 10 timesmoreef cient thanthecurrentlybest knownapproaches. |
| File Format | PDF HTM / HTML |
| Alternate Webpage(s) | https://web.archive.org/web/20080724170227/http://opera.cs.uiuc.edu/~lintan2/publications/strarch_isca05.pdf |
| Language | English |
| Access Restriction | Open |
| Content Type | Text |
| Resource Type | Article |
