Improvement of an Anagram Based NIDS by Reducing the Storage Space of Bloom Filters (Poster Abstract)
- 2.3k Downloads
When optimizing our NIDS APAP  we started focusing our efforts on ensuring that it would work on real-time network traffic. This effort, was penalized by the excessive cost of storage of various data structures needed to meet its goals satisfactorily.
APAP is based on Anagram  and initially worked with small size N-gram. This allowed us to detect more attacks at the expense of a higher rate of false positives. But when we wanted to test the results obtained with larger N-gram sizes, we found that the cost of storage of the Bloom filter structures that we generated to analyze the payload of the traffic was too large.
KeywordsStorage Space Anomaly Detector Poster Abstract Bloom Filter Excessive Cost
- 1.García-Villalba, L.J., Mejía-Castro, J.D., Sandoval-Orozco, A.L., Martínez-Puentes, J.: Malware Detection System by Payload Analysis of Network Traffic. In: Proceedings of the 15th International Symposium on Research in Attacks, Intrusions and Defenses (September 2012)Google Scholar
- 3.Broder, A., Mitzenmacher, M.: Network applications of bloom filters: A survey. In: Internet Mathematics, pp. 636–646 (2002)Google Scholar