Publication Details

Approximate Reduction of Finite Automata for High-Speed Network Intrusion Detection

ČEŠKA Milan, HAVLENA Vojtěch, HOLÍK Lukáš, LENGÁL Ondřej and VOJNAR Tomáš. Approximate Reduction of Finite Automata for High-Speed Network Intrusion Detection. International Journal on Software Tools for Technology Transfer, vol. 22, no. 5, 2020, pp. 523-539. ISSN 1433-2779. Available from: https://link.springer.com/article/10.1007/s10009-019-00520-8
Czech title
Přibližná redukce konečných automatů pro detekci útoků ve vysokorychlostních sítích
Type
journal article
Language
english
Authors
URL
Keywords

reduction, nondeterministic finite automata, deep packet inspection, high-speed network monitoring 

Abstract

We consider the problem of approximate reduction of non-deterministic automata that appear in hardware-accelerated network intrusion detection systems (NIDSes). We define an error distance of a reduced automaton from the original one as the probability of packets being incorrectly classified by the reduced automaton (wrt the probabilistic distribution of packets in the network traffic). We use this notion to design an approximate reduction procedure that achieves a great size reduction (much beyond the state-of-the-art language-preserving techniques) with a controlled and small error. We have implemented our approach and evaluated it on use cases from Snort, a popular NIDS. Our results provide experimental evidence that the method can be highly efficient in practice, allowing NIDSes to follow the rapid growth in the speed of networks.

Published
2020
Pages
523-539
Journal
International Journal on Software Tools for Technology Transfer, vol. 22, no. 5, ISSN 1433-2779
Publisher
Springer Verlag
DOI
UT WoS
000573269500001
EID Scopus
BibTeX
@ARTICLE{FITPUB11800,
   author = "Milan \v{C}e\v{s}ka and Vojt\v{e}ch Havlena and Luk\'{a}\v{s} Hol\'{i}k and Ond\v{r}ej Leng\'{a}l and Tom\'{a}\v{s} Vojnar",
   title = "Approximate Reduction of Finite Automata for High-Speed Network Intrusion Detection",
   pages = "523--539",
   journal = "International Journal on Software Tools for Technology Transfer",
   volume = 22,
   number = 5,
   year = 2020,
   ISSN = "1433-2779",
   doi = "10.1007/s10009-019-00520-8",
   language = "english",
   url = "https://www.fit.vut.cz/research/publication/11800"
}
Back to top