Skip to Main content Skip to Navigation
Conference papers

Fast Multipattern Matching for Intrusion Detection

Tarek Abbes 1 Michaël Rusinowitch 1
1 CASSIS - Combination of approaches to the security of infinite states systems
FEMTO-ST - Franche-Comté Électronique Mécanique, Thermique et Optique - Sciences et Technologies (UMR 6174), Inria Nancy - Grand Est, LORIA - FM - Department of Formal Methods
Abstract : Misuse intrusion detection (IDS) detects signatures of attack scenarios. Hackers try to avoid detection by permuting actions, and inserting, hiding or overlapping packets. Stateful detection becomes thus essential to suitably supervise network traffic. We propose in this paper a new approach for analysing the network traffic. The inspection, while being stateful, processes each packet as soon as it is received. We have used this strategy with appropriate multi-search methods and adequate datastructures for signatures.
Document type :
Conference papers
Complete list of metadata
Contributor : Publications Loria <>
Submitted on : Tuesday, September 26, 2006 - 10:13:18 AM
Last modification on : Friday, January 15, 2021 - 3:24:35 AM


  • HAL Id : inria-00100007, version 1


Tarek Abbes, Michaël Rusinowitch. Fast Multipattern Matching for Intrusion Detection. 13th Annual Conference on European Institute for Computer Anti-virus Research - EICAR'2004, May 2004, Luxemburg, Luxembourg, 22 p. ⟨inria-00100007⟩



Record views