Piranha: A Fast Lookup Pattern Matching Algorithm for Intrusion Detection

Network Intrusion Detection Systems (nIDS) are nowadays an increasingly important defensive mechanism against numerous attacks taking place on the Internet. As network speed is increasing faster than processor speed, intrusion detection at link speed becomes increasingly more challenging. The most expensive part of a nIDS is pattern matching: finding patterns of attack inside packet payload. This paper presents Piranha, a fast algorithm for pattern matching oriented to intrusion detection domain. It is based on the observation that if the rarest substring of a pattern does not appear, then the whole pattern will definitely not match. Our results, based on traces that represent various network environments, indicate that Piranha can enhance the performance of a nIDS by 11% to 28% in terms of processing time and by 18% to 73% in terms of memory consumption comparing to existing state-of-the-art algorithms.