High performance string matching algorithm for a Network Intrusion Prevention System (NIPS)

Yaron Weinsberg*, Shimrit Tzur-David, Danny Dolev, Tal Anker

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

38 Scopus citations

Abstract

Intrusion Detection systems (IDS) were developed to identify and report attacks in the late 1990s, as hacker attacks and network worms began to affect the internet. Traditional IDS technologies detect hostile traffic and send alerts but do nothing to stop the attacks. Network Intrusion Prevention Systems (NIPS) are deployed in-line with the network segment being protected. As the traffic passes through the NIPS, it is inspected for the presence of an attack. Like viruses, most intruder activities have some sort of signatures. Therefore, a pattern-matching algorithm resides at the heart of the NIPS. When an attack is identified, the NIPS blocks the offending data. There is an alleged trade-off between the accuracy of detection and algorithmic efficiency. Both are paramount in ensuring that legitimate traffic is not delayed or disrupted as it flows through the device. For this reason, the pattern-matching algorithm must be able to operate at wire speed, while simultaneously detecting the inn in bulk of intrusions. With networking speeds doubling every year, it is becoming increasingly difficult for software based solutions to keep up with the line rates. This paper presents a novel pattern-matching algorithm. The algorithm uses a Ternary Content Addressable Memory (TCAM) and is capable of matching multiple patterns in a single operation. The algorithm achieves line-rate speed of several orders of magnitude faster than current works, while attaining similar accuracy of detection. Furthermore, our system is fully compatible with Snort's rules syntax, which is the de facto standard for intrusion prevention systems.

Original languageEnglish
Title of host publication2006 Workshop on High Performance Switching and Routing, HPSR 2006
PublisherIEEE Computer Society
Pages147-154
Number of pages8
ISBN (Print)0780395697, 9780780395695
DOIs
StatePublished - 2006
Event2006 Workshop on High Performance Switching and Routing, HPSR 2006 - Poznan, Poland
Duration: 7 Jun 20069 Jun 2006

Publication series

Name2006 Workshop on High Performance Switching and Routing, HPSR 2006

Conference

Conference2006 Workshop on High Performance Switching and Routing, HPSR 2006
Country/TerritoryPoland
CityPoznan
Period7/06/069/06/06

Fingerprint

Dive into the research topics of 'High performance string matching algorithm for a Network Intrusion Prevention System (NIPS)'. Together they form a unique fingerprint.

Cite this