A New Packet Filter Schema Based on Multi-level Signature Hash and DFA Grouping

Packet filter system based on high speed match engine of REGular EXPressions (REGEXP) plays an important role in domain of Intrusion Detection System (IDS), Deep Packet Inspection (DPI) system, network security and traffic monitoring, etc. However, the existing filter schemas suffer from several deficiencies in matching speed and memory footprint, such as traditional DFA matching, single-level signature hash and DFA grouping. To overcome these shortcomings, in this paper, a new packet filter schema based on multilevel signature and DFA grouping is proposed. In particular, an algorithm called "DFA pseudo-split" is presented in our proposal to overcome the shortage of signatures. The experimental results show that our proposal significantly outperforms the traditional filter schemas.

I. Introduction

Due to the increasing number of attacks on application layer, the effectiveness of traditional network firewalls declines. Therefore, the Intrusion Detection System (IDS) emerges as the supplement of the traditional network firewalls, which consist of a device and the corresponding software application running on it. IDS is able to monitor network or system activities to determine whether there exists malicious ctivities or policy violations, and if it does, IDS will produce reports for a management station.