Institutional Repository [SANDBOX]
Technical University of Crete
EN  |  EL

Search

Browse

My Space

A Memory-Efficient reconfigurable aho-corasick FSM implementation for intrusion detection systems

Papaefstathiou Ioannis, Pnevmatikatos Dionysios, Dimopoulos V.

Full record


URI: http://purl.tuc.gr/dl/dias/E4A95C13-8C46-4689-B0E0-3D79E7072A0A
Year 2007
Type of Item Conference Full Paper
License
Details
Bibliographic Citation I. Papaefstathiou, D. Pnevmatikatos, V. Dimopoulos, "A Memory-Efficient Reconfigurable Aho-Corasick FSM Implementation for Intrusion Detection Systems," in International Conference on Embedded Computer Systems: Architectures, Modeling and Simulation, 2007, pp. 186 - 193. doi: 10.1109/ICSAMOS.2007.4285750 https://doi.org/10.1109/ICSAMOS.2007.4285750
Appears in Collections

Summary

The Aho-Corasick (AC) algorithm is a very flexible and efficient but memory-hungry pattern matching algorithm that can scan the existence of a query string among multiple test strings looking at each character exactly once, making it one of the main options for software-base intrusion detection systems such as SNORT. We present the Split-AC algorithm, which is a reconfigurable variation of the AC algorithm that exploits domain-specific characteristics of intrusion detection to reduce considerably the FSM memory requirements. SplitAC achieves an overall reduction between 28-75% compared to the best proposed implementation.

Services

Statistics