Multi-string matching for network intrusion detection

Abstract

In the new generation of the Network Intrusion Detection system (NIDS), due to the increase packet data that need to be inspected simultaneously, this creates the need of an advanced pattern-matching engine. In this project, in order to shorten the inspection time and reduce the workload for the inspecting system hardware, we investigated an efficient algorithm for multi-string matching, which is called the AC algorithm. It supports high data rate, dynamic update and it is one of the most storage-efficient schemes currently exists. This project will also include the simulation with 4300 patterns extracted from Snort, a worldwide NIDS, and the comparison with Jan van Lunteren’s new scheme for pattern-matching which is called the BFSM-based pattern-matching (BFPM) scheme. This may be the best pattern-matching algorithm nowadays.