A flexible affix byte-level string matching for network content filtering

Abstract

String matching is a classical problem in computer science. The technique is widely used in range of applications, such as pattern recognition, spelling checking, intrusion detection, worm containment, information retrieval and so on. String matching using the Deterministic Finite Automaton will be the performance bottleneck of network content filtering. We proposed a flexible affix byte-level string matching algorithm to reduce the unnecessary state transitions problem and reduce memory requirements. This proposed algorithm is based on the Byte-level string matching algorithm and it utilizes dynamic partitioning words to accelerate the matching speed. The proposed string matching algorithm was implemented in Snort for experimental performance evaluation. Comparing with the original algorithm, experimental result shows that the newly presented algorithm has gained much improvement on memory reduction, especially in detecting multiple keywords within a reliable network system.