Piecewise classification of attack patterns for efficient network intrusion detection

This paper presents a new scheme to improve the efficiency of pattern matching algorithms. The proposed approach is based on a piecewise classification of patterns using the common substrings. The main idea is to split the whole set of patterns into small subsets in accordance to the common substrings and treat the subsets independently. To reduce the number of patterns to match, we use the common substrings as an index for the search. We show that our algorithm is capable to outcome in term of performance other reference algorithms, such as Aho-Corasick.