Content Inspection Research Articles

Architecture-Aware Session Lookup Design for Inline Deep Inspection on Network Processors

Today's firewalls and security gateways are required to not only block unauthorized accesses by authenticating packet headers, but also inspect flow payloads against malicious intrusions. Deep inspection emerges as a seamless integration of packet classification for access control and pattern matching for intrusion prevention. The two function blocks are linked together via well-designed session lookup schemes. This paper presents an architecture-aware session lookup scheme for deep inspection on network processors (NPs). Test results show that the proposed session data structure and integration approach can achieve the OC-48 line rate (2.5 Gbps) with inline stateful content inspection on the Intel IXP2850 NP. This work provides an insight into application design and implementation on NPs and principles for performance tuning of NP-based programming such as data allocation, task partitioning, latency hiding, and thread synchronization.

Fast and Scalable Pattern Matching for Network Intrusion Detection Systems

High-speed packet content inspection and filtering devices rely on a fast multipattern matching algorithm which is used to detect predefined keywords or signatures in the packets. Multipattern matching is known to require intensive memory accesses and is often a performance bottleneck. Hence, specialized hardware-accelerated algorithms are required for line-speed packet processing. We present hardware-implementable pattern matching algorithm for content filtering applications, which is scalable in terms of speed, the number of patterns and the pattern length. Our algorithm is based on a memory efficient multihashing data structure called Bloom filter. We use embedded on-chip memory blocks in field programmable gate array/very large scale integration chips to construct Bloom filters which can suppress a large fraction of memory accesses and speed up string matching. Based on this concept, we first present a simple algorithm which can scan for several thousand short (up to 16 bytes) patterns at multigigabit per second speeds with a moderately small amount of embedded memory and a few mega bytes of external memory. Furthermore, we modify this algorithm to be able to handle arbitrarily large strings at the cost of a little more on-chip memory. We demonstrate the merit of our algorithm through theoretical analysis and simulations performed on Snort's string set

Personality‐relevant attribute‐nouns: a taxonomic study in the Italian language

The present study was based on psycholexical approach premises and explored the structure of a large set of personality attribute‐nouns in the Italian language. Content inspection (based on Big Five categories) and quantitative indices were used to interpret the attribute‐noun dimensions. Results showed (a) a stable three‐component solution which replicated the Big Three; (b) an unstable five‐factor solution which did not reproduce the Big Five; (c) an unstable six‐factor solution which represented deviations from the Big Five system, which have been found in most psycholexical studies conducted in the Italian language. The six lexical dimensions were interpreted as follows: Conscientiousness (replicating the III of the Big Five); Self‐Assurance (combining the Big Five I assertiveness and IV fearfulness subcategories); Sociability (defined by the Big Five I sociableness and I impulse expression subcategories); Placidity (combining the Big Five II peacefulness, II unassertiveness, and IV irritableness subcategories); Honesty and Humility (comprising the Big Five II modesty and II helpfulness subcategories plus integrity values); Cleverness and Sophistication (defined by the Big Five V subcategories). The conclusion was that personality word organisation in the Italian language reflects the psycholexical Big Three and Big Six, but not the Big Five. Copyright © 2005 John Wiley & Sons, Ltd.