HAL will be down for maintenance from Friday, June 10 at 4pm through Monday, June 13 at 9am. More information
Skip to Main content Skip to Navigation
Conference papers

Fast Multipattern Matching for Intrusion Detection

Tarek Abbes 1 Michaël Rusinowitch 1
1 CASSIS - Combination of approaches to the security of infinite states systems
FEMTO-ST - Franche-Comté Électronique Mécanique, Thermique et Optique - Sciences et Technologies (UMR 6174), Inria Nancy - Grand Est, LORIA - FM - Department of Formal Methods
Abstract : Misuse intrusion detection (IDS) detects signatures of attack scenarios. Hackers try to avoid detection by permuting actions, and inserting, hiding or overlapping packets. Stateful detection becomes thus essential to suitably supervise network traffic. We propose in this paper a new approach for analysing the network traffic. The inspection, while being stateful, processes each packet as soon as it is received. We have used this strategy with appropriate multi-search methods and adequate datastructures for signatures.
Document type :
Conference papers
Complete list of metadata

https://hal.inria.fr/inria-00100007
Contributor : Publications Loria Connect in order to contact the contributor
Submitted on : Tuesday, September 26, 2006 - 10:13:18 AM
Last modification on : Friday, January 21, 2022 - 3:08:59 AM

Identifiers

  • HAL Id : inria-00100007, version 1

Citation

Tarek Abbes, Michaël Rusinowitch. Fast Multipattern Matching for Intrusion Detection. 13th Annual Conference on European Institute for Computer Anti-virus Research - EICAR'2004, May 2004, Luxemburg, Luxembourg, 22 p. ⟨inria-00100007⟩

Share

Metrics

Record views

59