Boundary hash for memory-efficient deep packet inspection

N. Sertac Artan; Masanori Bando; H. Jonathan Chao

doi:10.1109/ICC.2008.333

Boundary hash for memory-efficient deep packet inspection

N. Sertac Artan, Masanori Bando, H. Jonathan Chao

Electrical and Computer Engineering

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

Network Intrusion Detection and Prevention Systems (NIDPSs) are critical for network security. The Deep Packet Inspection (DPI) operation consumes a significant amount of resources in NIDPS. This is because to detect malicious activity DPI searches a database of signatures for each byte of every packet. In this paper, we develop a highly space-efficient data structure for hardware realization of Minimal Perfect Hash Functions (MPHFs). This data structure is simple to construct, requires 7n bits to represent the MPHF for a set of n keys and allows high-speed DPI.

Original language	English (US)
Title of host publication	ICC 2008 - IEEE International Conference on Communications, Proceedings
Pages	1732-1737
Number of pages	6
DOIs	https://doi.org/10.1109/ICC.2008.333
State	Published - 2008
Event	IEEE International Conference on Communications, ICC 2008 - Beijing, China Duration: May 19 2008 → May 23 2008

Publication series

Name	IEEE International Conference on Communications
ISSN (Print)	0536-1486

Other

Other	IEEE International Conference on Communications, ICC 2008
Country/Territory	China
City	Beijing
Period	5/19/08 → 5/23/08

Keywords

Boundary hash
DPI
Deep packet inspection
Minimal perfect hash functions
NIDPS
Network intrusion detection and prevention system
Network security
Snort
TriBiCa
Trie bitmap content analyzer

ASJC Scopus subject areas

Computer Networks and Communications
Electrical and Electronic Engineering

Access to Document

10.1109/ICC.2008.333

Cite this

@inproceedings{bc89161812a54aa79ceeffcf52a88b51,

title = "Boundary hash for memory-efficient deep packet inspection",

abstract = "Network Intrusion Detection and Prevention Systems (NIDPSs) are critical for network security. The Deep Packet Inspection (DPI) operation consumes a significant amount of resources in NIDPS. This is because to detect malicious activity DPI searches a database of signatures for each byte of every packet. In this paper, we develop a highly space-efficient data structure for hardware realization of Minimal Perfect Hash Functions (MPHFs). This data structure is simple to construct, requires 7n bits to represent the MPHF for a set of n keys and allows high-speed DPI.",

keywords = "Boundary hash, DPI, Deep packet inspection, Minimal perfect hash functions, NIDPS, Network intrusion detection and prevention system, Network security, Snort, TriBiCa, Trie bitmap content analyzer",

author = "Artan, {N. Sertac} and Masanori Bando and Chao, {H. Jonathan}",

year = "2008",

doi = "10.1109/ICC.2008.333",

language = "English (US)",

isbn = "9781424420742",

series = "IEEE International Conference on Communications",

pages = "1732--1737",

booktitle = "ICC 2008 - IEEE International Conference on Communications, Proceedings",

note = "IEEE International Conference on Communications, ICC 2008 ; Conference date: 19-05-2008 Through 23-05-2008",

}

TY - GEN

T1 - Boundary hash for memory-efficient deep packet inspection

AU - Artan, N. Sertac

AU - Bando, Masanori

AU - Chao, H. Jonathan

PY - 2008

Y1 - 2008

N2 - Network Intrusion Detection and Prevention Systems (NIDPSs) are critical for network security. The Deep Packet Inspection (DPI) operation consumes a significant amount of resources in NIDPS. This is because to detect malicious activity DPI searches a database of signatures for each byte of every packet. In this paper, we develop a highly space-efficient data structure for hardware realization of Minimal Perfect Hash Functions (MPHFs). This data structure is simple to construct, requires 7n bits to represent the MPHF for a set of n keys and allows high-speed DPI.

AB - Network Intrusion Detection and Prevention Systems (NIDPSs) are critical for network security. The Deep Packet Inspection (DPI) operation consumes a significant amount of resources in NIDPS. This is because to detect malicious activity DPI searches a database of signatures for each byte of every packet. In this paper, we develop a highly space-efficient data structure for hardware realization of Minimal Perfect Hash Functions (MPHFs). This data structure is simple to construct, requires 7n bits to represent the MPHF for a set of n keys and allows high-speed DPI.

KW - Boundary hash

KW - DPI

KW - Deep packet inspection

KW - Minimal perfect hash functions

KW - NIDPS

KW - Network intrusion detection and prevention system

KW - Network security

KW - Snort

KW - TriBiCa

KW - Trie bitmap content analyzer

UR - http://www.scopus.com/inward/record.url?scp=51249094491&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=51249094491&partnerID=8YFLogxK

U2 - 10.1109/ICC.2008.333

DO - 10.1109/ICC.2008.333

M3 - Conference contribution

AN - SCOPUS:51249094491

SN - 9781424420742

T3 - IEEE International Conference on Communications

SP - 1732

EP - 1737

BT - ICC 2008 - IEEE International Conference on Communications, Proceedings

T2 - IEEE International Conference on Communications, ICC 2008

Y2 - 19 May 2008 through 23 May 2008

ER -

Boundary hash for memory-efficient deep packet inspection

Abstract

Publication series

Other

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this