Fast content-based packet handling for intrusion detection

It is becoming increasingly common for network de-vices to handle packets based on the contents of packet payloads. Example applications include in-trusion detection, firewalls, web proxies, and layer seven switches. This paper analyzes the problem of intrusion detection and its reliance on fast string matching in packets. We show that the problem can be restructured to allow the use of more ef-ficient string matching algorithms that operate on sets of patterns in parallel. We then introduce and analyze a new string matching algorithm that has average-case performance that is better than Aho-Corasick, a popular linear-time algorithm and much better than the iterative use of Boyer-Moore cur-rently used in the popular intrusion detection platform Snort. We then measure the actual performance of several search algorithms on actual packet traces and rulesets. Our results provide lessons on the structuring of content-based handlers, string match-ing algorithms in general, and the importance of performance to security.