Abstract
The rapid advancement of high speed networks has resulted in a significantly increasing number of network packets per second nowadays, implying network intrusion detection systems (NIDSs) need to accelerate the inspection of packet content to protect the computer systems from attacks. On average, the pattern matching process in a NIDS consumes approximately 70% of the overall processing time. The conventional Aho–Corasick (AC) algorithm, adopting a finite state machine to identify attack patterns in NIDSs, is too slow to meet the requirement of high speed networks. In view of this, several studies have used the features of a graphics processing unit (GPU) to improve the core searching process of the AC algorithm. For instance, parallel failureless Aho-Corasick (PFAC) algorithm improves the process of pattern matching effectively by removing backward branches in the original finite state machine created using the AC algorithm. In this way, boundary detection can be avoided totally if we allocate an individual thread to each byte of an input stream to identify any pattern starting at the thread’s starting position. However, through analysis, we found that this algorithm experiences a serious load imbalance problem. Therefore, this paper proposes a two-phase PFAC algorithm to address the problem. A threshold is predefined to divide execution into two phases, and the failureless finite state machine is also decoupled into two parts accordingly. In the first phase, every thread identifies patterns by running the tiny part of the decoupled failureless finite state machine that are stored in fast shared memory. In the second phase, all the threads requiring further searching in a same block are regrouped into a few warps for less branch divergence. According to experimental results, the proposed algorithm shows a performance improvement of 50% compared to the PFAC algorithm.
Highlights
A network intrusion detection system (NIDS) [1] is widely used to protect computer systems from hidden dangerous attacks such as denial of service, malware, and port scan
Experimental results demonstrate that our two-phase algorithm garners a performance improvement of 50% compared to the parallel failureless Aho-Corasick (PFAC) algorithm
graphics processing unit (GPU) have been widely used in many fields to accelerate calculation-intensive problems, such as range query and nearest neighbors query [11,12,13,14,15], where range query is to find all the objects that are at a definite distance from the consulted object from a large collection of stored objects in a metric database [11,12] while nearest neighbors query is to find the k nearest neighbor objects to a given point in space [13,14,15]
Summary
A network intrusion detection system (NIDS) [1] is widely used to protect computer systems from hidden dangerous attacks such as denial of service, malware, and port scan. Because the number of packets per second arrived in the network continuously increase, conventional string matching algorithms cannot efficiently analyze such an enormous amount of network traffic to meet the demand of high-speed data transmission. In this case, network congestion may occur or a large amount of data may be discarded, which can increase computer security threats or degrade the quality of network service. In the PFAC algorithm, all backward state transitions in the finite state machine (FSM) in the AC algorithm are all eliminated and the derived one is called a failureless FSM They let each byte in an input stream be the starting byte for a thread to match patterns using the failureless FSM. The rest of this paper is organized as follows: Section 2 presents related work on pattern matching, Section 3 describes the proposed method, Section 4 presents the experimental results, and Section 5 provides the conclusions and scope for future work
Sign-in/Register to view highlights & summary Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
