E2XB: A domain-specific string matching algorithm for intrusion detection

K. G. Anagnostakis; S. Antonatos; E. P. Markatos; M. Polychronakis

doi:10.1007/978-0-387-35691-4

E²XB: A domain-specific string matching algorithm for intrusion detection

K. G. Anagnostakis
, S. Antonatos
, E. P. Markatos
, M. Polychronakis

Computer Science

Foundation for Research and Technology-Hellas
University of Pennsylvania

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

52 Scopus citations

Abstract

We consider the problem of string matching in Network Intrusion Detection Systems (NIDSes). String matching computations dominate in the overall cost of running a NIDS, despite the use of efficient general-purpose string matching algorithms. Aiming at increasing the efficiency and capacity of NIDSes, we have designed E²xB, a string matching algorithm that is tailored to the specific characteristics of NIDS string matching. We have implemented E²xB in snort, a popular open-source NIDS, and present experiments comparing E²xB with the current best alternative solution. Our results suggest that for typical traffic patterns E²xB improves NIDS performance by 10%-36%, while for certain rule set and traffic patterns string matching performance can be improved by as much as a factor of three.

Original language	English
Title of host publication	Security and Privacy in the age of Uncertainty - IFIP TC11 18th International Conference on Information Security, SEC 2003
Publisher	Springer New York LLC
Pages	217-229
Number of pages	13
ISBN (Print)	9781475764895
DOIs	https://doi.org/10.1007/978-0-387-35691-4
State	Published - 2003
Event	IFIP TC11 18th International Conference on Information Security, SEC 2003 - Athens, Greece Duration: May 26 2003 → May 28 2003

Publication series

Name	IFIP Advances in Information and Communication Technology
Volume	122
ISSN (Print)	1868-4238

Conference

Conference	IFIP TC11 18th International Conference on Information Security, SEC 2003
Country/Territory	Greece
City	Athens
Period	05/26/03 → 05/28/03

Keywords

Intrusion detection
Network monitoring
Network performance
Network security
String matching

Access to Document

10.1007/978-0-387-35691-4

Cite this

Anagnostakis, K. G., Antonatos, S., Markatos, E. P., & Polychronakis, M. (2003). E²XB: A domain-specific string matching algorithm for intrusion detection. In Security and Privacy in the age of Uncertainty - IFIP TC11 18th International Conference on Information Security, SEC 2003 (pp. 217-229). (IFIP Advances in Information and Communication Technology; Vol. 122). Springer New York LLC. https://doi.org/10.1007/978-0-387-35691-4

@inproceedings{db11486e6eb34491b831dcf38479c3b4,

title = "E2XB: A domain-specific string matching algorithm for intrusion detection",

abstract = "We consider the problem of string matching in Network Intrusion Detection Systems (NIDSes). String matching computations dominate in the overall cost of running a NIDS, despite the use of efficient general-purpose string matching algorithms. Aiming at increasing the efficiency and capacity of NIDSes, we have designed E2xB, a string matching algorithm that is tailored to the specific characteristics of NIDS string matching. We have implemented E2xB in snort, a popular open-source NIDS, and present experiments comparing E2xB with the current best alternative solution. Our results suggest that for typical traffic patterns E2xB improves NIDS performance by 10\%-36\%, while for certain rule set and traffic patterns string matching performance can be improved by as much as a factor of three.",

keywords = "Intrusion detection, Network monitoring, Network performance, Network security, String matching",

author = "Anagnostakis, \{K. G.\} and S. Antonatos and Markatos, \{E. P.\} and M. Polychronakis",

year = "2003",

doi = "10.1007/978-0-387-35691-4",

language = "English",

isbn = "9781475764895",

series = "IFIP Advances in Information and Communication Technology",

publisher = "Springer New York LLC",

pages = "217--229",

booktitle = "Security and Privacy in the age of Uncertainty - IFIP TC11 18th International Conference on Information Security, SEC 2003",

note = "IFIP TC11 18th International Conference on Information Security, SEC 2003 ; Conference date: 26-05-2003 Through 28-05-2003",

}

Anagnostakis, KG, Antonatos, S, Markatos, EP & Polychronakis, M 2003, E²XB: A domain-specific string matching algorithm for intrusion detection. in Security and Privacy in the age of Uncertainty - IFIP TC11 18th International Conference on Information Security, SEC 2003. IFIP Advances in Information and Communication Technology, vol. 122, Springer New York LLC, pp. 217-229, IFIP TC11 18th International Conference on Information Security, SEC 2003, Athens, Greece, 05/26/03. https://doi.org/10.1007/978-0-387-35691-4

E²XB: A domain-specific string matching algorithm for intrusion detection. / Anagnostakis, K. G.; Antonatos, S.; Markatos, E. P. et al.
Security and Privacy in the age of Uncertainty - IFIP TC11 18th International Conference on Information Security, SEC 2003. Springer New York LLC, 2003. p. 217-229 (IFIP Advances in Information and Communication Technology; Vol. 122).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - E2XB

T2 - IFIP TC11 18th International Conference on Information Security, SEC 2003

AU - Anagnostakis, K. G.

AU - Antonatos, S.

AU - Markatos, E. P.

AU - Polychronakis, M.

PY - 2003

Y1 - 2003

N2 - We consider the problem of string matching in Network Intrusion Detection Systems (NIDSes). String matching computations dominate in the overall cost of running a NIDS, despite the use of efficient general-purpose string matching algorithms. Aiming at increasing the efficiency and capacity of NIDSes, we have designed E2xB, a string matching algorithm that is tailored to the specific characteristics of NIDS string matching. We have implemented E2xB in snort, a popular open-source NIDS, and present experiments comparing E2xB with the current best alternative solution. Our results suggest that for typical traffic patterns E2xB improves NIDS performance by 10%-36%, while for certain rule set and traffic patterns string matching performance can be improved by as much as a factor of three.

AB - We consider the problem of string matching in Network Intrusion Detection Systems (NIDSes). String matching computations dominate in the overall cost of running a NIDS, despite the use of efficient general-purpose string matching algorithms. Aiming at increasing the efficiency and capacity of NIDSes, we have designed E2xB, a string matching algorithm that is tailored to the specific characteristics of NIDS string matching. We have implemented E2xB in snort, a popular open-source NIDS, and present experiments comparing E2xB with the current best alternative solution. Our results suggest that for typical traffic patterns E2xB improves NIDS performance by 10%-36%, while for certain rule set and traffic patterns string matching performance can be improved by as much as a factor of three.

KW - Intrusion detection

KW - Network monitoring

KW - Network performance

KW - Network security

KW - String matching

UR - https://www.scopus.com/pages/publications/84904280510

U2 - 10.1007/978-0-387-35691-4

DO - 10.1007/978-0-387-35691-4

M3 - Conference contribution

AN - SCOPUS:84904280510

SN - 9781475764895

T3 - IFIP Advances in Information and Communication Technology

SP - 217

EP - 229

BT - Security and Privacy in the age of Uncertainty - IFIP TC11 18th International Conference on Information Security, SEC 2003

PB - Springer New York LLC

Y2 - 26 May 2003 through 28 May 2003

ER -

Anagnostakis KG, Antonatos S, Markatos EP, Polychronakis M. E²XB: A domain-specific string matching algorithm for intrusion detection. In Security and Privacy in the age of Uncertainty - IFIP TC11 18th International Conference on Information Security, SEC 2003. Springer New York LLC. 2003. p. 217-229. (IFIP Advances in Information and Communication Technology). doi: 10.1007/978-0-387-35691-4