Skip to Main content Skip to Navigation
Conference papers

Fast Multipattern Matching for Intrusion Detection

Tarek Abbes 1 Michaël Rusinowitch 1
1 CASSIS - Combination of approaches to the security of infinite states systems
FEMTO-ST - Franche-Comté Électronique Mécanique, Thermique et Optique - Sciences et Technologies (UMR 6174), Inria Nancy - Grand Est, LORIA - FM - Department of Formal Methods
Abstract : Misuse intrusion detection (IDS) detects signatures of attack scenarios. Hackers try to avoid detection by permuting actions, and inserting, hiding or overlapping packets. Stateful detection becomes thus essential to suitably supervise network traffic. We propose in this paper a new approach for analysing the network traffic. The inspection, while being stateful, processes each packet as soon as it is received. We have used this strategy with appropriate multi-search methods and adequate datastructures for signatures.
Document type :
Conference papers
Complete list of metadata

https://hal.inria.fr/inria-00100007
Contributor : Publications Loria <>
Submitted on : Tuesday, September 26, 2006 - 10:13:18 AM
Last modification on : Friday, January 15, 2021 - 3:24:35 AM

Identifiers

  • HAL Id : inria-00100007, version 1

Citation

Tarek Abbes, Michaël Rusinowitch. Fast Multipattern Matching for Intrusion Detection. 13th Annual Conference on European Institute for Computer Anti-virus Research - EICAR'2004, May 2004, Luxemburg, Luxembourg, 22 p. ⟨inria-00100007⟩

Share

Metrics

Record views

222