Optimization of pattern matching algorithm for memory based architecture

Due to the advantages of easy re-configurability and scalability, the memory-based string matching architecture is widely adopted by network intrusion detection systems (NIDS). In order to accommodate the increasing number of attack patterns and meet the throughput requirement of networks, a successful NIDS system must have a memory-efficient pattern-matching algorithm and hardware design. In this paper, we propose a memory-efficient pattern-matching algorithm which can significantly reduce the memory requirement. For total Snort string patterns, the new algorithm achieves 29% of memory reduction compared with the traditional Aho-Corasick algorithm [5]. Moreover, since our approach is orthogonal to other memory reduction approaches, we can obtain substantial gain even after applying the existing state-of-the-art algorithms. For example, after applying the bit-split algorithm [9], we can still gain an additional 22% of memory reduction. Categories and Subject Descriptors C.2.0 [Compute...

• Type: Conference
• Year: 2007
• Where: ANCS
• Authors: Cheng-Hung Lin, Yu-Tang Tai, Shih-Chieh Chang
• Keywords: ANCS 2007, Computer Networks, Intrusion Detection, Memory Reduction, Memory-efficient Pattern-matching Algorithm