Hierarchical multi-pattern matching algorithm for network content inspection
- 作者：Tzu-Fang Sheu ; Nen-Fu Huang ; Hsiao-Ping Lee
- 关键词：Network security ; Network-level security and protection ; Real-time and embedded systems ; Intrusion detection ; Pattern matching ; Content inspection
- 刊名：Information Sciences
- 出版年：2008
- 期刊代码：62_00200255
- 类别：cp
- 出版时间：15 July 2008
- 卷：178
- 期：14
- 页码：2880-2898
- 文件大小：1370 K
摘要
Inspection engines that can inspect network content for application-layer information are urgently required. In-depth packet inspection engines, which search the whole packet payload, can identify the interested packets that contain certain patterns. Network equipment then utilizes the searching results from the inspection engines for application-oriented management. The most important technology for fast packet inspection is an efficient multi-pattern matching algorithm to perform exact string matching between packets and a large set of patterns. This paper proposes a novel hierarchical multi-pattern matching algorithm (HMA) for packet inspection. HMA builds hierarchical index tables from the most frequent common-codes, and efficiently reduces the amount of external memory accesses and memory space by two-tier and cluster-wise matching. Analysis and simulation results reveal that HMA performs much better than state-of-the-art matching algorithms. In particular, HMA can update patterns incrementally, thus creating a reliable network system.