tailieunhanh - Efficient Pattern Matching Algorithm for Memory Architecture

Network intrusion detection system is used to inspect packet contents against thousands of predefined malicious or suspicious patterns. Because traditional software alone pattern matching approaches can no longer meet the high throughput of today’s networking, many hardware approaches are proposed to accelerate pattern matching. | This article has been accepted for inclusion in a future issue of this journal. Content is final as presented with the exception of pagination. 1 IEEE TRANSACTIONS ON VERY LARGE SCALE INTEGRATION VLSI SYSTEMS Efficient Pattern Matching Algorithm for Memory Architecture Cheng-Hung Lin Member IEEE and Shih-Chieh Chang Member IEEE Abstract Network intrusion detection system is used to inspect packet contents against thousands of predefined malicious or suspicious patterns. Because traditional software alone pattern matching approaches can no longer meet the high throughput of today s networking many hardware approaches are proposed to accelerate pattern matching. Among hardware approaches memory-based architecture has attracted a lot of attention because of its easy reconfigurability and scalability. In order to accommodate the increasing number of attack patterns and meet the throughput requirement of networks a successful network intrusion detection system must have a memory-efficient pattern-matching algorithm and hardware design. In this paper we propose a memory-efficient pattern-matching algorithm which can significantly reduce the memory requirement. For Snort rule sets the new algorithm achieves 21 of memory reduction compared with the traditional Aho-Corasick algorithm. In addition we can gain 24 of memory reduction by integrating our approach to the bit-split algorithm which is the state-of-the-art memory-based approach. Index Terms Aho-Corasick AC algorithm finite automata pattern matching. I. Introduction The main purpose of a signature-based network intrusion detection system is to prevent malicious network attacks by identifying known attack patterns. Due to the increasing complexity of network traffic and the growing number of attacks an intrusion detection system must be efficient flexible and scalable. The primary function of an intrusion detection system is to perform matching of attack string patterns. Because string matching is the most computative