Deterministic memory-efficient string matching algorithms for intrusion detection
Deterministic memory-efficient string matching algorithms for intrusion detection
复制标题
DOI：
10.1109/infcom.2004.1354682
复制
发表时间：
2004-03
期刊：
影响因子：
--
通讯作者：
Nathan Tuck;T. Sherwood;B. Calder;G. Varghese
中科院分区：
文献类型：
--
作者：
Nathan Tuck;T. Sherwood;B. Calder;G. Varghese
Intrusion detection systems (IDSs) have become widely recognized as powerful tools for identifying, deterring and deflecting malicious attacks over the network. Essential to almost every intrusion detection system is the ability to search through packets and identify content that matches known attacks. Space and time efficient string matching algorithms are therefore important for identifying these packets at line rate. We examine string matching algorithms and their use for intrusion detection, in particular, we focus our efforts on providing worst-case performance that is amenable to hardware implementation. We contribute modifications to the Aho-Corasick string-matching algorithm that drastically reduce the amount of memory required and improve its performance on hardware implementations. We also show that these modifications do not drastically affect software performance on commodity processors, and therefore may be worth considering in these cases as well.
