KSII Transactions on Internet and Information Systems (TIIS)

Korean Society for Internet Information (한국인터넷정보학회)
권호 표지
DOI QR코드

DOI QR Code

Probabilistic Model for Performance Analysis of a Heuristic with Multi-byte Suffix Matching

  • Received : 2012.12.13
  • Accepted : 2013.04.05
  • Published : 2013.04.30
Download PDF
⟨ Previous Next ⟩

Abstract

A heuristic with multi-byte suffix matching plays an important role in real pattern matching algorithms. By skipping many characters at a time in the process of comparing a given pattern with the text, the pattern matching algorithm based on a heuristic with multi-byte suffix matching shows a faster average search time than algorithms based on deterministic finite automata. Based on various experimental results and simulations, the previous works show that the pattern matching algorithms with multi-byte suffix matching performs well. However, there have been limited studies on the mathematical model for analyzing the performance in a standard manner. In this paper, we propose a new probabilistic model, which evaluates the performance of a heuristic with multi-byte suffix matching in an average-case search. When the theoretical analysis results and experimental results were compared, the proposed probabilistic model was found to be sufficient for evaluating the performance of a heuristic with suffix matching in the real pattern matching algorithms.

Keywords

References

  1. A. Aho and M. Corasick, "Efficient string matching: An aid to bibliographic search," Communications of the ACM, vol. 18, no. 6, pp. 333-343, 1975. https://doi.org/10.1145/360825.360855
  2. Nathan Tuck, Timothy Sherwood, Brad Calder, and George Varghese, "Deterministic Memory-Efficient String Matching Algorithms for Intrusion Detection," in Proc. of the 23rd Conference of the IEEE Communications Society(IEEE INFOCOM 2004), 2004.
  3. R. Smith, C. Estan and S. Jha, "XFA: Faster signature matching with extended automata," IEEE Symposium on Security and Privacy (Oakland), May 2008.
  4. N. Hua, H. Song and T.V. Lakshman, "Variable-Stride Multi-Pattern Matching For Scalable Deep Packet Inspection," in Proc. of the 28th Conference on Computer Communications(INFOCOM 2009), Apr. 2009.
  5. R.S. Boyer and J.S. Moore, "A Fast String Searching Algorithm," Communications of the ACM, vol. 20(10), pp. 762-772, 1977. https://doi.org/10.1145/359842.359859
  6. A. Apostolico, R. Giancarlo, "The Boyer-Moore-Galil string searching strategies revisited," SIAM Journal on Computing, vol. 15, no. 1, pp. 98-105, 1986. https://doi.org/10.1137/0215007
  7. B. Commentz-Walter, "A string matching algorithm fast on the average," in Proc. of the 6th International Colloquium on Automata, Languages, and Programming, pp. 118-132, 1979.
  8. B. Xu, X. Zhou, J. Li, "Recursive shift indexing: a fast multi-pattern string matching algorithm," in Proc. of the 4th International Conference on Applied Cryptography and Network Security (ACNS), 2006.
  9. Rong-Tai Liu, Nen-Fu Huang, Chih-Hao Chen, Chia-Nan Kao, "A fast string-matching algorithm for network processor-based intrusion detection system," ACM Transactions on Embedded Computing Systems (TECS), vol. 3, no. 3 , pp. 614-633, 2004. https://doi.org/10.1145/1015047.1015055
  10. R. Horspool, "Practical fast searching in strings. Software Practice and Experience," vol. 10, no. 6, pp. 501-506, 1980. https://doi.org/10.1002/spe.4380100608
  11. M. Fish and G. Varghese, "Fast Content-Based Packet Handling for Intrusion Detection," UCSD TR CS2001-0670, 2001.
  12. M.Fish and G.Varghese, "An analysis of fast string matching applied to content-based forwarding and intrusion detection," UCSD technical report CS2001-0670, 2002.
  13. Giorgos Vasiliadis, Michalis Polychronakis, Spiros Antonatos, Evangelos P. Markatos, Sotiris Ioannidis, "Regular expression matching on graphics hardware for intrusion detection," in Proc. of the 12th International Symposium On Recent Advances In Intrusion Detection (RAID), 2009.
  14. Y.-H. Choi, M.-Y. Jung and S.-W. Seo, "A fast pattern matching algorithm with multi-byte search unit for high-speed network security," Elsevier Computer Communications(ComCom), vol. 34, no. 14, pp. 1750-1763, Sep. 2011. https://doi.org/10.1016/j.comcom.2011.03.014
  15. Wu, S. and Manber, U, "A fast algorithm for multi-pattern searching," Department of Computer Science, University of Arizona. TR94-17, 1994.
  16. S. Antonatos, K.G. Anagnostakis, E.P. Markatos, and M. Polychronakis, "Performance Analysis of Content Matching Intrusion Detection Systems," in Proc. of the IEEE/IPSJ Symposium on Applications and the Internet(SAINT 2004), pp. 26-30, Jan. 2004.
  17. P.-C. Lin, Z.-X. Li, Y.-D. Lin, Y.-C. Lai and F.-C. Lin, "Profiling and accelerating string matching algorithms in three network content security applications," Communications Surveys & Tutorials IEEE, Volume: 8, Issue: 2, Page(s): 24-37, Feb., 2007.
  18. Sourcefire, Inc., "SnortTM Users Manual 2.8.4," The Snort Project, Apr. 2009.