An Efficient and Scalable Pattern Matching Scheme for Network Security Applications

An Efficient and Scalable Pattern Matching Scheme for Network

Security Applications

Department of Computer Science and Information Engineering National Cheng Kung University, Taiwan R.O.C.

Authors: Tsern-Huei Lee; Nai-Lun HuangPublisher: Computer Communications and Networks, 2008. ICCCN '08. Proceedings of 17th International Conference on3-7 Aug. 2008 Page(s)1 - 7 Present: Chia-Ming ,Chang Date: 3, 4, 2009

1

Outline 1. Introduction 2. Architecture 3. Experimental results 4. Conclusion

2

Introduction (1/3)

3

Introduction (2/3)

4

Introduction (3/3)

5

Outline 1. Introduction 2. Architecture 3. Experimental results 4. Conclusion

6

Architecture (1/3) Σ= {a, b, c, d, e, f, g, h} Σ are sequentially encoded as 0, 1, 2, 3, 4, 5,6 and 7

Y= {abcda (0), abba (1), cda (2), cabc (3)}.

7

Architecture (2/3)

8

Architecture (3/3)

9

Outline 1. Introduction 2. Architecture 3. Experimental results 4. Conclusion

10

Experimental results (1/3)

11

Experimental results (2/3)

12

Experimental results (3/3)

13

Outline 1. Introduction 2. Architecture 3. Experimental results 4. Conclusion

14

Conclusion (1/1)

15

we first present an idea to improve the throughput performance of the banded-row format AC and then propose a scalable implementation of the Aho-Corasick pattern matching algorithm.

our proposed implementation achieves 39.7% reduction in memory requirement for 5,000 pattern strings randomly selected from ClamAV signatures and 16.1% reduction in processing time on the average for scanning various types of files.