Concurrent multiple-patterns snooping for intrusion detection systems

Intrusion detection systems (IDSs) are the effective means to foil malicious attacks over the network. The capacity of these systems mainly depends on the efficiency of the underlying multiple-patterns detection algorithms. In this paper, we extend our early single pattern matching scheme, comparison tree (CT), to work on concurrent multiple patterns detection problem. We discuss how to exploit various compression techniques to conserve the memory usage for better speed tradeoffs on commodity CPUs. The experiments from realistic workloads evidence that our new design can significantly speed up the detection at the minimal memory cost among the existing competitors. Moderate additional memory space will allow further speed gain.