In-Depth Packet Inspection Using a Hierarchical Pattern Matching Algorithm

Detection engines capable of inspecting packet payloads for application-layer network information are urgently required. The most important technology for fast payload inspection is an efficient multipattern matching algorithm, which performs exact string matching between packets and a large set of...

Full description

Saved in:
Bibliographic Details
Published in:IEEE transactions on dependable and secure computing Vol. 7; no. 2; pp. 175 - 188
Main Authors: Sheu, Tzu-Fang, Huang, Nen-Fu, Lee, Hsiao-Ping
Format: Journal Article
Language:English
Published: Washington IEEE 01.04.2010
IEEE Computer Society
Subjects:
Algorithms
Clustering algorithms
Clusters
Computer programs
Computer science
Computer simulation
content inspection
Digital Object Identifier
Heuristic
Information security
Inspection
Inspections
Intrusion detection
Intrusion detection systems
Load management
Matching
Network security
Network-level security and protection
Networks
Pattern matching
Pattern recognition
Payloads
Search engines
Security management
Software
Studies
Web and internet services
Network-level security and protection
Network monitoring
ISSN:1545-5971, 1941-0018
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Detection engines capable of inspecting packet payloads for application-layer network information are urgently required. The most important technology for fast payload inspection is an efficient multipattern matching algorithm, which performs exact string matching between packets and a large set of predefined patterns. This paper proposes a novel Enhanced Hierarchical Multipattern Matching Algorithm (EHMA) for packet inspection. Based on the occurrence frequency of grams, a small set of the most frequent grams is discovered and used in the EHMA. EHMA is a two-tier and cluster-wise matching algorithm, which significantly reduces the amount of external memory accesses and the capacity of memory. Using a skippable scan strategy, EHMA speeds up the scanning process. Furthermore, independent of parallel and special functions, EHMA is very simple and therefore practical for both software and hardware implementations. Simulation results reveal that EHMA significantly improves the matching performance. The speed of EHMA is about 0.89-1,161 times faster than that of current matching algorithms. Even under real-life intense attack, EHMA still performs well.
Bibliography:SourceType-Scholarly Journals-1
ObjectType-Feature-1
content type line 14
ObjectType-Article-1
ObjectType-Feature-2
content type line 23
ISSN:1545-5971
1941-0018
DOI:10.1109/TDSC.2008.57