Counting Bloom Filters for Pattern Matching and Anti-Evasion at the Wire Speed

Standard pattern-matching methods used for deep packet inspection and network security can be evaded by means of TCP and IP fragmentation. To detect such attacks, intrusion detection systems must reassemble packets before applying matching algorithms, thus requiring a large amount of memory and time...

Full description

Saved in:
Bibliographic Details
Published inIEEE network Vol. 23; no. 1; p. 1
Main Authors Antichi, Gianni, Ficara, Domenico, Giordano, Stefano, Procissi, Gregorio, Vitucci, Fabio
Format Journal Article
LanguageEnglish
Published New York The Institute of Electrical and Electronics Engineers, Inc. (IEEE) 01.01.2009
Subjects
Algorithms
Internet Protocol
Network security
TCP-IP
Online AccessGet full text

Cover

More Information
Summary:Standard pattern-matching methods used for deep packet inspection and network security can be evaded by means of TCP and IP fragmentation. To detect such attacks, intrusion detection systems must reassemble packets before applying matching algorithms, thus requiring a large amount of memory and time to respond to the threat. In the literature, only a few efforts proposed a method to detect evasion attacks at high speed without reassembly. The aim of this article is to introduce an efficient system for anti-evasion that can be implemented in real devices. It is based on counting Bloom filters and exploits their capabilities to quickly update the string set and deal with partial signatures. In this way, the detection of attacks and almost all of the traffic processing is performed in the fast data path, thus improving the scalability of intrusion detection systems. [PUBLICATION ABSTRACT]
ISSN:0890-8044
1558-156X