Towards faster string matching for intrusion detection or exceeding the speed of Snort

by: Jason C Coit, Stuart Staniford, Joseph Mcalerney

DARPA Information Survivability Conference & Exposition II, 2001. DISCEX '01. Proceedings, Vol. 1 (2001), pp. 367-373 vol.1.

View FullText article

IEEE Explore

Reviews [Write a review of this article]

There are no reviews of this article

Find related articles from these CiteULike users

sunniesheu, mnajem

Find related articles with these CiteULike tags

hma, idssnort, intrusion_detection

Abstract

Network intrusion detection systems (NIDS) often rely on exact string matching techniques. Depending on the choice of algorithm, implementation and the frequency with which it is applied, this pattern matching may become a performance bottleneck. To keep up with increasing network speeds and traffic, NIDS can take advantage of advanced string matching algorithms. We describe the effectiveness of a significantly faster approach to pattern matching in the open source NIDS Snort

@inproceedings{Coit01, abstract = {Network intrusion detection systems (NIDS) often rely on exact string matching techniques. Depending on the choice of algorithm, implementation and the frequency with which it is applied, this pattern matching may become a performance bottleneck. To keep up with increasing network speeds and traffic, NIDS can take advantage of advanced string matching algorithms. We describe the effectiveness of a significantly faster approach to pattern matching in the open source NIDS Snort}, author = {Coit, Jason C. and Staniford, Stuart and Mcalerney, Joseph }, booktitle = {Proceedings of the 2nd DARPA Information Survivability Conference and Exposition}, citeulike-article-id = {366733}, journal = {DARPA Information Survivability Conference \& Exposition II, 2001. DISCEX '01. Proceedings}, keywords = {hma, intrusion\_detection}, pages = {367--373 vol.1}, posted-at = {2005-10-27 14:20:59}, priority = {0}, title = {Towards faster string matching for intrusion detection or exceeding the speed of Snort}, url = {http://ieeexplore.ieee.org/xpls/abs\_all.jsp?arnumber=932231}, volume = {1}, year = {2001} }

RIS record

TY - CONF ID - Coit01 L3 - citeulike-article-id:366733 N2 - Network intrusion detection systems (NIDS) often rely on exact string matching techniques. Depending on the choice of algorithm, implementation and the frequency with which it is applied, this pattern matching may become a performance bottleneck. To keep up with increasing network speeds and traffic, NIDS can take advantage of advanced string matching algorithms. We describe the effectiveness of a significantly faster approach to pattern matching in the open source NIDS Snort JF - DARPA Information Survivability Conference & Exposition II, 2001. DISCEX '01. Proceedings EP - 373 vol.1 TI - Towards faster string matching for intrusion detection or exceeding the speed of Snort VL - 1 T2 - Proceedings of the 2nd DARPA Information Survivability Conference and Exposition SP - 367 KW - hma KW - intrusion_detection AU - Coit, Jason AU - Staniford, Stuart AU - Mcalerney, Joseph PY - 2001/// UR - http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=932231 ER -

RIS BibTeX