[go: up one dir, main page]

Lin, 2010 - Google Patents

Bits filter: a high-performance multiple string pattern matching algorithm for malware detection

Lin, 2010

View PDF
Document ID
5575349892326746309
Author
Lin D
Publication year

External Links

Snippet

Multiple string pattern matching is the key technique of many security applications such as anti-virus scanning and intrusion detection. The growing size of on-line content and increasing network and CPU speed push the need for a fast multi-string search algorithm …
Continue reading at summit.sfu.ca (PDF) (other versions)

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING; COUNTING
    • G06F—ELECTRICAL DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G06F21/563—Static detection by source code analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING; COUNTING
    • G06F—ELECTRICAL DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/30—Information retrieval; Database structures therefor; File system structures therefor
    • G06F17/30943—Information retrieval; Database structures therefor; File system structures therefor details of database functions independent of the retrieved data type
    • G06F17/30964—Querying
    • G06F17/30979—Query processing
    • G06F17/30985—Query processing by using string matching techniques
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING; COUNTING
    • G06F—ELECTRICAL DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/30—Information retrieval; Database structures therefor; File system structures therefor
    • G06F17/3061—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
    • G06F17/30613—Indexing
    • G06F17/30619—Indexing indexing structures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING; COUNTING
    • G06F—ELECTRICAL DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/30—Information retrieval; Database structures therefor; File system structures therefor
    • G06F17/30943—Information retrieval; Database structures therefor; File system structures therefor details of database functions independent of the retrieved data type
    • G06F17/30946—Information retrieval; Database structures therefor; File system structures therefor details of database functions independent of the retrieved data type indexing structures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING; COUNTING
    • G06F—ELECTRICAL DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/30—Information retrieval; Database structures therefor; File system structures therefor
    • G06F17/30861—Retrieval from the Internet, e.g. browsers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Similar Documents

Publication Publication Date Title
Becchi et al. Memory-efficient regular expression search using state merging
Yu et al. GPU acceleration of regular expression matching for large datasets: exploring the implementation space
Liu et al. A fast string-matching algorithm for network processor-based intrusion detection system
Yu et al. Fast and memory-efficient regular expression matching for deep packet inspection
Antonello et al. Deep packet inspection tools and techniques in commodity platforms: Challenges and trends
Clark et al. Design of efficient FPGA circuits for matching complex patterns in network intrusion detection systems
Alicherry et al. High speed pattern matching for network IDS/IPS
CN107122221B (en) compiler for regular expressions
Pao et al. A memory-efficient pipelined implementation of the aho-corasick string-matching algorithm
US10176187B2 (en) Method and apparatus for generating a plurality of indexed data fields
Najam et al. Speculative parallel pattern matching using stride-k DFA for deep packet inspection
Abdulhammed et al. Network intrusion detection using hardware techniques: A review
Wang et al. Memory-based architecture for multicharacter Aho–Corasick string matching
Rasool et al. A novel json based regular expression language for pattern matching in the internet of things
Villa et al. Input-independent, scalable and fast string matching on the Cray XMT
Lin et al. Profiling and accelerating string matching algorithms in three network content security applications
Fide et al. A survey of string matching approaches in hardware
Zhou et al. MRSI: A fast pattern matching algorithm for anti-virus applications
Liu et al. A prefiltering approach to regular expression matching for network security systems
Tripp A finite-state-machine based string matching system for intrusion detection on high-speed networks
Bille et al. Fast practical compression of deterministic finite automata
Lin Bits filter: a high-performance multiple string pattern matching algorithm for malware detection
Wang et al. Kangaroo: Accelerating string matching by running multiple collaborative finite state machines
Tseng et al. A fast scalable automaton-matching accelerator for embedded content processors
Nourani et al. Bloom filter accelerator for string matching