Efficient multiple pattern matching algorithms for network intrusion detection systems

Abstract

Multiple pattern matching algorithms are essential engines of Network Intrusion Detection Systems (NIDSs) to inspect packets for occurrences of malicious patterns. For a set of patterns, the multiple pattern matching algorithms usually build a trie data structure. In this paper, we propose efficient implementations of the multiple pattern matching algorithms widely used in NIDSs by using a linearized compact trie. This linearized compact trie is an array representation of a compact trie and guarantees a size linear to the number of patterns with little loss of lookup time. Thus, our implementations achieve compact sizes with fast time, so it is useful to hardware embedding and cache exploiting.