Performance Study of the Running Times of well known Pattern Matching Algorithms for Signature-based Intrusion Detection Systems

Abstract

Intrusion detection system (IDS) is the basic component of any network defense scheme. Signature based intrusion detection techniques are widely used in networks for fast response to detect threats. One of the main challenges faced by signature-based IDS is that every signature requires an entry in the database, and so a complete database might contain hundreds or even thousands of entries. Each packet is to be compared with all the entries in the database. This can be highly resource-consuming and doing so will slow down the throughput and making the IDS vulnerable. Since pattern matching computations dominate in the overall performance of a Signature-based IDS, efficient pattern matching algorithms should be used which use minimal computer storage and which minimize the searching response time. In this paper we present a performance study of the running times of different well known pattern matching algorithms using multiple sliding windows approach.
DOI: 10.17762/ijritcc2321-8169.1506138