Improved Pattern Matching Method for Intrusion Detection Systems under DDoS Attack

Abstract

Increasing popularity of the internet usage is causing many DDoS attacks such as 7.7 DDoS in 2009 and 3.4 DDoS in 2011 in South Korea. A DDoS attack is one of the simplest and most powerful cyber-attacks. DDoS attack is getting a huge problem because the unspecified individuals (called zombie PCs) are used in loading malicious codes while attacking a single site or system. Network security appliances such as IDSes (Intrusion Detection Systems) and DDoS attack prevention systems detect attacks by signature-based pattern matching. These appliances check the full data payload of packets to find abnormal signatures. Then reducing the packet inspection time is one of the most important challenges of improving the performance of these systems because pattern matching methods affect the total execution time. In this paper, we analyze network attack events are collected on two DDoS defense systems which are operated by KISA (KrCERT/CC) in Korea. Then we propose improved pattern matching method using multicore process.