Speeding Up the String Comparison of the IDS Snort using Parallel Programming: A Systematic Literature Review on the Parallelized Aho-Corasick Algorithm
The Intrusion Detection System (IDS) needs to compare the contents of all packets arriving at the network interface with a set of signatures for indicating possible attacks, a task that consumes much CPU processing time. In order to alleviate this problem, some researchers have tried to parallelize...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Faculdade Salesiana Maria Auxiliadora
2016-12-01
|
| Series: | Sistemas de Informação |
| Subjects: | |
| Online Access: | http://www.fsma.edu.br/si/edicao18/Download_FSMA_SI_2016_2_Estudantil_6.html |
| _version_ | 1819138437116067840 |
|---|---|
| author | SILVA JUNIOR,J. B. MORENO, E. D.; NUNES, M. A. S. N. |
| author_facet | SILVA JUNIOR,J. B. MORENO, E. D.; NUNES, M. A. S. N. |
| author_sort | SILVA JUNIOR,J. B. |
| collection | DOAJ |
| description | The Intrusion Detection System (IDS) needs to compare the contents of all packets arriving at the network interface with a set of signatures for indicating possible attacks, a task that consumes much CPU processing time. In order to alleviate this problem, some researchers have tried to parallelize the IDS's comparison engine, transferring execution from the CPU to GPU. This paper identifies and maps the parallelization features of the Aho-Corasick algorithm, which is used in Snort to compare patterns, in order to show this algorithm's implementation and execution issues, as well as optimization techniques for the Aho-Corasick machine. We have found 147 papers from important computer science publications databases, and have mapped them. We selected 22 and analyzed them in order to find our results. Our analysis of the papers showed, among other results, that parallelization of the AC algorithm is a new task and the authors have focused on the State Transition Table as the most common way to implement the algorithm on the GPU. Furthermore, we found that some techniques speed up the algorithm and reduce the required machine storage space are highly used, such as the algorithm running on the fastest memories and mechanisms for reducing the number of nodes and bit maping. |
| first_indexed | 2024-12-22T11:06:45Z |
| format | Article |
| id | doaj.art-0d540439463d438b9ef752c908d54aff |
| institution | Directory Open Access Journal |
| issn | 1983-5604 1983-5604 |
| language | English |
| last_indexed | 2024-12-22T11:06:45Z |
| publishDate | 2016-12-01 |
| publisher | Faculdade Salesiana Maria Auxiliadora |
| record_format | Article |
| series | Sistemas de Informação |
| spelling | doaj.art-0d540439463d438b9ef752c908d54aff2022-12-21T18:28:16ZengFaculdade Salesiana Maria AuxiliadoraSistemas de Informação1983-56041983-56042016-12-011185865Speeding Up the String Comparison of the IDS Snort using Parallel Programming: A Systematic Literature Review on the Parallelized Aho-Corasick AlgorithmSILVA JUNIOR,J. B.0MORENO, E. D.; 1NUNES, M. A. S. N.2UFSUFSUFSThe Intrusion Detection System (IDS) needs to compare the contents of all packets arriving at the network interface with a set of signatures for indicating possible attacks, a task that consumes much CPU processing time. In order to alleviate this problem, some researchers have tried to parallelize the IDS's comparison engine, transferring execution from the CPU to GPU. This paper identifies and maps the parallelization features of the Aho-Corasick algorithm, which is used in Snort to compare patterns, in order to show this algorithm's implementation and execution issues, as well as optimization techniques for the Aho-Corasick machine. We have found 147 papers from important computer science publications databases, and have mapped them. We selected 22 and analyzed them in order to find our results. Our analysis of the papers showed, among other results, that parallelization of the AC algorithm is a new task and the authors have focused on the State Transition Table as the most common way to implement the algorithm on the GPU. Furthermore, we found that some techniques speed up the algorithm and reduce the required machine storage space are highly used, such as the algorithm running on the fastest memories and mechanisms for reducing the number of nodes and bit maping.http://www.fsma.edu.br/si/edicao18/Download_FSMA_SI_2016_2_Estudantil_6.htmlAho-Corasickstring matchingIDSSystematic Literature Mappingparallel processing. |
| spellingShingle | SILVA JUNIOR,J. B. MORENO, E. D.; NUNES, M. A. S. N. Speeding Up the String Comparison of the IDS Snort using Parallel Programming: A Systematic Literature Review on the Parallelized Aho-Corasick Algorithm Sistemas de Informação Aho-Corasick string matching IDS Systematic Literature Mapping parallel processing. |
| title | Speeding Up the String Comparison of the IDS Snort using Parallel Programming: A Systematic Literature Review on the Parallelized Aho-Corasick Algorithm |
| title_full | Speeding Up the String Comparison of the IDS Snort using Parallel Programming: A Systematic Literature Review on the Parallelized Aho-Corasick Algorithm |
| title_fullStr | Speeding Up the String Comparison of the IDS Snort using Parallel Programming: A Systematic Literature Review on the Parallelized Aho-Corasick Algorithm |
| title_full_unstemmed | Speeding Up the String Comparison of the IDS Snort using Parallel Programming: A Systematic Literature Review on the Parallelized Aho-Corasick Algorithm |
| title_short | Speeding Up the String Comparison of the IDS Snort using Parallel Programming: A Systematic Literature Review on the Parallelized Aho-Corasick Algorithm |
| title_sort | speeding up the string comparison of the ids snort using parallel programming a systematic literature review on the parallelized aho corasick algorithm |
| topic | Aho-Corasick string matching IDS Systematic Literature Mapping parallel processing. |
| url | http://www.fsma.edu.br/si/edicao18/Download_FSMA_SI_2016_2_Estudantil_6.html |
| work_keys_str_mv | AT silvajuniorjb speedingupthestringcomparisonoftheidssnortusingparallelprogrammingasystematicliteraturereviewontheparallelizedahocorasickalgorithm AT morenoed speedingupthestringcomparisonoftheidssnortusingparallelprogrammingasystematicliteraturereviewontheparallelizedahocorasickalgorithm AT nunesmasn speedingupthestringcomparisonoftheidssnortusingparallelprogrammingasystematicliteraturereviewontheparallelizedahocorasickalgorithm |