International Conference on Information Technology: Coding and Computing (ITCC'04) Volume 1
A Fast Pattern-Match Engine for Network Processor-based Network Intrusion Detection System
Las Vegas, Nevada
April 05-April 07
ISBN: 0-7695-2108-8
Network Intrusion Detection Systems (NIDS) are one of the latest developments in security. The matching of packet strings against collected signatures dominates signature-based NIDS performance. This work presents FNP2, an efficient pattern-matching engine designed for Network Processor platform which conducts matching sets of patterns in parallel. This work shows that combining our string matching methodology, hashing engine supported by most Network Processors, and characteristics of current Snort signatures frequently improves performance and reduces number of memory accesses compared to current NIDS pattern matching algorithms. Another contribution is to highlight that, besides total number of searching patterns, shortest pattern length is also a major influence on NIDS multi-pattern matching algorithm performance.
Citation:
Rong-Tai Liu, Nen-Fu Huang, Chia-Nan Kao, Chih-Hao Chen, Chi-Chieh Chou, "A Fast Pattern-Match Engine for Network Processor-based Network Intrusion Detection System," itcc, vol. 1, pp.97, International Conference on Information Technology: Coding and Computing (ITCC'04) Volume 1, 2004