Advertisement

MDH: A High Speed Multi-phase Dynamic Hash String Matching Algorithm for Large-Scale Pattern Set

  • Zongwei Zhou
  • Yibo Xue
  • Junda Liu
  • Wei Zhang
  • Jun Li
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4861)

Abstract

String matching algorithm is one of the key technologies in numerous network security applications and systems. Nowadays, the increasing network bandwidth and pattern set size both calls for high speed string matching algorithm for large-scale pattern set. This paper proposes a novel algorithm called Multi-phase Dynamic Hash (MDH), which cut down the memory requirement by multi-phase hash and explore valuable pattern set information to speed up searching procedure by dynamic-cut heuristics. The experimental results demonstrate that MDH can improve matching performance by 100% to 300% comparing with other popular algorithms, whereas the memory requirement stays in a comparatively low level.

Keywords

Network Security String Matching Algorithm Multi-Phases Hash Dynamic-Cut Heuristics 

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Roesch, M.: Snort: lightweight intrusion detection for networks. In: Proc. of the 1999 USENIX LISA Systems Administration Conference (1999) Google Scholar
  2. 2.
    Clam AntiVirusTM http://www.clamav.net/
  3. 3.
    Navarro, G., Raffinot, M.: Flexible pattern matching in strings. Cambridge University Press, Cambridge (2002)CrossRefzbMATHGoogle Scholar
  4. 4.
    Wu, S., Manber, U.: A fast algorithm for multi-pattern searching, Technical Report TR-94-17, Department of Computer Science, University of Arizona (1994) Google Scholar
  5. 5.
  6. 6.
    Aho, A., Corasick, M.: Fast pattern matching: an aid to bibliographic search. Journal on Communication ACM 18(6), 333–340 (1975)CrossRefzbMATHGoogle Scholar
  7. 7.
    Boyer, R., Moore, J.: A fast string searching algorithm. Journal on Communication. ACM 20(10), 762–772 (1977)CrossRefzbMATHGoogle Scholar
  8. 8.
    Coit, C., Staniford, S., McAlerney, J.: Towards faster string matching for intrusion detection or exceeding the speed of snort, DARPA Information Survivability Conference and Exposition, pp. 367–373 (2001) Google Scholar
  9. 9.
    Fisk, M., Varghese, G.: An analysis of fast string matching applied to content-based forwarding and intrusion detection. Technical Report CS2001-0607 (updated version), University of California-San Diego (2002) Google Scholar
  10. 10.
    Xu, B., Zhou, X., Li, J.: Recursive shift indexing: a fast multi-pattern string matching Algorithm. In: Zhou, J., Yung, M., Bao, F. (eds.) ACNS 2006. LNCS, vol. 3989, Springer, Heidelberg (2006)Google Scholar
  11. 11.
    Kytojoki, J., Salmela, L., Tarhio, J.: Tuning string matching for huge pattern sets? In: Baeza-Yates, R.A., Chávez, E., Crochemore, M. (eds.) CPM 2003. LNCS, vol. 2676, pp. 211–224. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  12. 12.
    Allauzen, C., Raffinot, M.: Factor oracle of a set of words, Technical report 99-11, Institut Gaspard-Monge, Universite de Marne-la-Vallee (1999) Google Scholar
  13. 13.
    National Computer Network Emergency Response Technical Team/Coordination Center of China, http://www.cert.org.cn/
  14. 14.
    Network Security Lab: Research Institute of Information Technology, Tsinghua University, Beijing, http://security.riit.tsinghua.edu.cn/share/pattern.html

Copyright information

© Springer-Verlag Berlin Heidelberg 2007

Authors and Affiliations

  • Zongwei Zhou
    • 1
    • 2
  • Yibo Xue
    • 2
    • 3
  • Junda Liu
    • 1
    • 2
  • Wei Zhang
    • 1
    • 2
  • Jun Li
    • 2
    • 3
  1. 1.Department of Computer Science and Technology, Tsinghua University, BeijingChina
  2. 2.Research Institute of Information Technology, Tsinghua University, BeijingChina
  3. 3.Tsinghua National Laboratory for Information Science and Technology, BeijingChina

Personalised recommendations