Multi pattern matching technique on fragmented and out-of-order packet streams for intrusion detection system

Abstract

In this paper we are discussing about Intrusion Detection System based on Deterministic Finite-State Automata (DFA). The proposed system is designed to deal the fragmented and out-of-order packets. Fragmentation is the term given to the process of breaking down an IP datagram into smaller packets to be transmitted over different types of network media and then reassembling them at the other end. In most cases, depending upon the actual security device defending the network, there are typically multiple fragmentation techniques and packet size combinations capable of squeezing and exploiting protection device on a network. We present an efficient multi pattern algorithm for regular expression matching on streams with fragmented and out of order data, while maintaining a small state and without complete stream reconstruction. It improves the performance of Intrusion Detection System for detecting the fragmented and Out-of-Order packet attack. The proposed technique helps to achieve high throughput while limiting both memory-usage and memory-bandwidth on fragmented data packets intrusion.