A hardware platform for efficient worm outbreak detection
ACM Transactions on Design Automation of Electronic Systems (TODAES), 2009•dl.acm.org
Network Intrusion Detection Systems (NIDS) monitor network traffic to detect attacks or
unauthorized activities. Traditional NIDSes search for patterns that match typical network
compromise or remote hacking attempts. However, newer networking applications require
finding the frequently repeated strings in a packet stream for further investigation of potential
attack attempts. Finding frequently repeated strings within a given time frame of the packet
stream has been quite efficient to detect polymorphic worm outbreaks. A novel real-time …
unauthorized activities. Traditional NIDSes search for patterns that match typical network
compromise or remote hacking attempts. However, newer networking applications require
finding the frequently repeated strings in a packet stream for further investigation of potential
attack attempts. Finding frequently repeated strings within a given time frame of the packet
stream has been quite efficient to detect polymorphic worm outbreaks. A novel real-time …
Network Intrusion Detection Systems (NIDS) monitor network traffic to detect attacks or unauthorized activities. Traditional NIDSes search for patterns that match typical network compromise or remote hacking attempts. However, newer networking applications require finding the frequently repeated strings in a packet stream for further investigation of potential attack attempts. Finding frequently repeated strings within a given time frame of the packet stream has been quite efficient to detect polymorphic worm outbreaks. A novel real-time worm outbreak detection system using two-phase hashing and monitoring repeated common substrings is proposed in this article. We use the concept of shared counters to minimize the memory cost while efficiently sifting through suspicious strings. The worm outbreak system has been prototyped on Altera Stratix FPGA. We have tested the system for various settings and packet stream sizes. Experimental results verify that our system can support line speed of gigabit-rates with negligible false positive and negative rates.

Showing the best result for this search. See all results