Predictive pattern matching for scalable network intrusion detection

Abstract

Signature-based network intrusion detection requires fast and reconfigurable pattern matching for deep packet inspection. This paper presents a novel pattern matching engine, which exploits a memory-based programmable state machine to achieve deterministic processing rates that are independent of packet and pattern characteristics. Our engine is a portable predictive pattern matching finite state machine (P3 FSM), which combines the properties of hardware-based systems with the portability and programmability of software. Specifically we introduce two methods, "Character Aware" and "SDFA", for encoding predictive state codes which can forecast the next states of our FSM. The result is software based pattern matching which is fast, reconfigurable, memory-efficient and portable. © 2009 Springer-Verlag.