Piranha: Fast and memory-efficient pattern matching for intrusion detection

S. Antonatos; M. Polychronakis; P. Akritidis; K. G. Anagnostakis; E. P. Markatos

doi:10.1007/0-387-25660-1_26

Piranha: Fast and memory-efficient pattern matching for intrusion detection

S. Antonatos
, M. Polychronakis
, P. Akritidis
, K. G. Anagnostakis
, E. P. Markatos

Computer Science

Foundation for Research and Technology-Hellas
University of Pennsylvania

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

17 Scopus citations

Abstract

Network Intrusion Detection Systems (NIDS) provide an important security function to help defend against network attacks. As network speeds and detection workloads increase, it is important for NIDSes to be highly efficient. Most NIDSes need to check for thousands of known attack patterns in every packet, making pattern matching the most expensive part of signature-based NIDSes in terms of processing and memory resources. This paper describes Piranha, a new algorithm for pattern matching tailored specifically for intrusion detection. Piranha is based on the observation that if the rarest substring of a pattern does not appear, then the whole pattern will definitely not match. Our experimental results, based on traces that represent typical NIDS workloads, indicate that Piranha can enhance the performance of a NIDS by 11% to 28% in terms of processing time and by 18% to 73% in terms of memory usage compared to existing NIDS pattern matching algorithms.

Original language	English
Title of host publication	Security and Privacy in the Age of Ubiquitous Computing - IFIP TC11 20th International Information Security Conference
Editors	Sihan Qing, Eiji Okamoto, Hiroshi Yoshiura, Ryoichi Sasaki
Publisher	Springer New York LLC
Pages	393-408
Number of pages	16
ISBN (Print)	9780387256580
DOIs	https://doi.org/10.1007/0-387-25660-1_26
State	Published - 2005
Event	IFIP TC11 20th International Information Security Conference, IFIP/SEC2005 - Chiba, Japan Duration: May 30 2005 → Jun 1 2005

Publication series

Name	IFIP Advances in Information and Communication Technology
Volume	181
ISSN (Print)	1868-4238

Conference

Conference	IFIP TC11 20th International Information Security Conference, IFIP/SEC2005
Country/Territory	Japan
City	Chiba
Period	05/30/05 → 06/1/05

Keywords

intrusion detection
network monitoring
network performance
network security
pattern matching

Access to Document

10.1007/0-387-25660-1_26

Cite this

Antonatos, S., Polychronakis, M., Akritidis, P., Anagnostakis, K. G., & Markatos, E. P. (2005). Piranha: Fast and memory-efficient pattern matching for intrusion detection. In S. Qing, E. Okamoto, H. Yoshiura, & R. Sasaki (Eds.), Security and Privacy in the Age of Ubiquitous Computing - IFIP TC11 20th International Information Security Conference (pp. 393-408). (IFIP Advances in Information and Communication Technology; Vol. 181). Springer New York LLC. https://doi.org/10.1007/0-387-25660-1_26

Antonatos, S. ; Polychronakis, M. ; Akritidis, P. et al. / Piranha : Fast and memory-efficient pattern matching for intrusion detection. Security and Privacy in the Age of Ubiquitous Computing - IFIP TC11 20th International Information Security Conference. editor / Sihan Qing ; Eiji Okamoto ; Hiroshi Yoshiura ; Ryoichi Sasaki. Springer New York LLC, 2005. pp. 393-408 (IFIP Advances in Information and Communication Technology).

@inproceedings{e55fc6ad6537410a8485879fdb782efc,

title = "Piranha: Fast and memory-efficient pattern matching for intrusion detection",

abstract = "Network Intrusion Detection Systems (NIDS) provide an important security function to help defend against network attacks. As network speeds and detection workloads increase, it is important for NIDSes to be highly efficient. Most NIDSes need to check for thousands of known attack patterns in every packet, making pattern matching the most expensive part of signature-based NIDSes in terms of processing and memory resources. This paper describes Piranha, a new algorithm for pattern matching tailored specifically for intrusion detection. Piranha is based on the observation that if the rarest substring of a pattern does not appear, then the whole pattern will definitely not match. Our experimental results, based on traces that represent typical NIDS workloads, indicate that Piranha can enhance the performance of a NIDS by 11\% to 28\% in terms of processing time and by 18\% to 73\% in terms of memory usage compared to existing NIDS pattern matching algorithms.",

keywords = "intrusion detection, network monitoring, network performance, network security, pattern matching",

author = "S. Antonatos and M. Polychronakis and P. Akritidis and Anagnostakis, \{K. G.\} and Markatos, \{E. P.\}",

year = "2005",

doi = "10.1007/0-387-25660-1\_26",

language = "English",

isbn = "9780387256580",

series = "IFIP Advances in Information and Communication Technology",

publisher = "Springer New York LLC",

pages = "393--408",

editor = "Sihan Qing and Eiji Okamoto and Hiroshi Yoshiura and Ryoichi Sasaki",

booktitle = "Security and Privacy in the Age of Ubiquitous Computing - IFIP TC11 20th International Information Security Conference",

note = "IFIP TC11 20th International Information Security Conference, IFIP/SEC2005 ; Conference date: 30-05-2005 Through 01-06-2005",

}

Antonatos, S, Polychronakis, M, Akritidis, P, Anagnostakis, KG & Markatos, EP 2005, Piranha: Fast and memory-efficient pattern matching for intrusion detection. in S Qing, E Okamoto, H Yoshiura & R Sasaki (eds), Security and Privacy in the Age of Ubiquitous Computing - IFIP TC11 20th International Information Security Conference. IFIP Advances in Information and Communication Technology, vol. 181, Springer New York LLC, pp. 393-408, IFIP TC11 20th International Information Security Conference, IFIP/SEC2005, Chiba, Japan, 05/30/05. https://doi.org/10.1007/0-387-25660-1_26

Piranha: Fast and memory-efficient pattern matching for intrusion detection. / Antonatos, S.; Polychronakis, M.; Akritidis, P. et al.
Security and Privacy in the Age of Ubiquitous Computing - IFIP TC11 20th International Information Security Conference. ed. / Sihan Qing; Eiji Okamoto; Hiroshi Yoshiura; Ryoichi Sasaki. Springer New York LLC, 2005. p. 393-408 (IFIP Advances in Information and Communication Technology; Vol. 181).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Piranha

T2 - IFIP TC11 20th International Information Security Conference, IFIP/SEC2005

AU - Antonatos, S.

AU - Polychronakis, M.

AU - Akritidis, P.

AU - Anagnostakis, K. G.

AU - Markatos, E. P.

PY - 2005

Y1 - 2005

N2 - Network Intrusion Detection Systems (NIDS) provide an important security function to help defend against network attacks. As network speeds and detection workloads increase, it is important for NIDSes to be highly efficient. Most NIDSes need to check for thousands of known attack patterns in every packet, making pattern matching the most expensive part of signature-based NIDSes in terms of processing and memory resources. This paper describes Piranha, a new algorithm for pattern matching tailored specifically for intrusion detection. Piranha is based on the observation that if the rarest substring of a pattern does not appear, then the whole pattern will definitely not match. Our experimental results, based on traces that represent typical NIDS workloads, indicate that Piranha can enhance the performance of a NIDS by 11% to 28% in terms of processing time and by 18% to 73% in terms of memory usage compared to existing NIDS pattern matching algorithms.

AB - Network Intrusion Detection Systems (NIDS) provide an important security function to help defend against network attacks. As network speeds and detection workloads increase, it is important for NIDSes to be highly efficient. Most NIDSes need to check for thousands of known attack patterns in every packet, making pattern matching the most expensive part of signature-based NIDSes in terms of processing and memory resources. This paper describes Piranha, a new algorithm for pattern matching tailored specifically for intrusion detection. Piranha is based on the observation that if the rarest substring of a pattern does not appear, then the whole pattern will definitely not match. Our experimental results, based on traces that represent typical NIDS workloads, indicate that Piranha can enhance the performance of a NIDS by 11% to 28% in terms of processing time and by 18% to 73% in terms of memory usage compared to existing NIDS pattern matching algorithms.

KW - intrusion detection

KW - network monitoring

KW - network performance

KW - network security

KW - pattern matching

UR - https://www.scopus.com/pages/publications/80052773066

U2 - 10.1007/0-387-25660-1_26

DO - 10.1007/0-387-25660-1_26

M3 - Conference contribution

AN - SCOPUS:80052773066

SN - 9780387256580

T3 - IFIP Advances in Information and Communication Technology

SP - 393

EP - 408

BT - Security and Privacy in the Age of Ubiquitous Computing - IFIP TC11 20th International Information Security Conference

A2 - Qing, Sihan

A2 - Okamoto, Eiji

A2 - Yoshiura, Hiroshi

A2 - Sasaki, Ryoichi

PB - Springer New York LLC

Y2 - 30 May 2005 through 1 June 2005

ER -

Antonatos S, Polychronakis M, Akritidis P, Anagnostakis KG, Markatos EP. Piranha: Fast and memory-efficient pattern matching for intrusion detection. In Qing S, Okamoto E, Yoshiura H, Sasaki R, editors, Security and Privacy in the Age of Ubiquitous Computing - IFIP TC11 20th International Information Security Conference. Springer New York LLC. 2005. p. 393-408. (IFIP Advances in Information and Communication Technology). doi: 10.1007/0-387-25660-1_26

Piranha: Fast and memory-efficient pattern matching for intrusion detection

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this