E 2 xB: A Domain-Specific String Matching Algorithm for Intrusion Detection
Kostas G. Anagnostakis, Spiros Antonatos, Evangelos P. Markatos, Michalis Polychronakis · 2003
We consider the problem of string matching in Network Intrusion Detection Systems (NIDSes). String matching computations dominate in the overall cost of running a NIDS, despite the use of efficient general-purpose string matching algorithms. Aiming at increasing the efficiency and capacity of NIDSes, we have designed E 2 xB, a string matching algorithm that is tailored to the specific characteristics of NIDS string matching. We have implemented E 2 xB in snort, a popular open-source NIDS, and present experiments comparing E 2 xB with the current best alternative solution. Our results suggest that for typical traffic patterns E 2 xB improves NIDS performance by 10%–36%, while for certain ruleset and traffic patterns string matching performance can be improved by as much as a factor of three.