A Distributed Implementation of Signature Matching Algorithms for IoT Intrusion Detection

Abstract

Listen

Translate article

Common software systems manage large databases and huge incoming and outgoing data. A major security risk is the intrusion of viruses via devices connected to the system network. Each virus has a unique signature. Early detection of these signatures is the core of most anti-virus software packages. Each anti-virus uses a multi-string-matching algorithm to detect the existence of a virus signature in the incoming data or a given data file. String matching uses pre-defined signature lists, which are growing fast and may contain a few million entries. Studies show that anti-viruses may have an impact on the data transmission performance and propose ways to cope with it either by enhancing the processing power, improvements to the matching algorithms and apply selective detection with low-risk probability. The introduction of the Internet of things (IoT) exposes the Internet to major security risks as numerous devices are expected to be connected to the Internet. IoT devices have poor processing resources, and it is not able to run himself proper anti-virus software and so, allowing malicious virus attacks without any way to prevent it. Some solutions propose incorporating in the IoT environment a powerful security gateway processor to handle the anti-virus aspect. This solution is against the concept of IoT as an independent entity able to cope with such challenges. This paper presents a hierarchical distributed and parallel processing framework that accelerates multi-string matching for IoT devices by utilizing the accumulated excess processing power of the local IoT devices network, eliminating the need for high capacity robust computers.