NetShield: Massive semantics-based vulnerability signature matching for high-speed networks

Zhichun Li*, Gao Xia, Hongyu Gao, Yi Tang, Yan Chen, Bin Liu, Junchen Jiang, Yuezhou Lv

*Corresponding author for this work

Research output: Contribution to journalArticle

10 Scopus citations

Abstract

Accuracy and speed are the two most important metrics for Network Intrusion Detection/Prevention Systems (NIDS/NIPSes). Due to emerging polymorphic attacks and the fact that in many cases regular expressions (regexes) cannot capture the vulnerability conditions accurately, the accuracy of existing regex-based NIDS/NIPS systems has become a serious problem. In contrast, the recently-proposed vulnerability signatures (a.k.a data patches) can exactly describe the vulnerability conditions and achieve better accuracy. However, how to efficiently apply vulnerability signatures to high speed NIDS/NIPS with a large ruleset remains an untouched but challenging issue. This paper presents the first systematic design of vulnerability signature based parsing and matching engine, NetShield, which achieves multi-gigabit throughput while offering much better accuracy. Particularly, we made the following contributions: (i) we proposed a candidate selection algorithm which efficiently matches thousands of vulnerability signatures simultaneously requiring a small amount of memory; (ii) we proposed an automatic lightweight parsing state machine achieving fast protocol parsing. Experimental results show that the core engine of NetShield achieves at least 1.9+Gbps signature matching throughput on a 3.8GHz single-core PC, and can scale-up to at least 11+Gbps under a 8-core machine for 794 HTTP vulnerability signatures.

Original languageEnglish (US)
Pages (from-to)279-290
Number of pages12
JournalComputer Communication Review
Volume40
Issue number4
DOIs
StatePublished - Dec 1 2010

Keywords

  • Deep packet inspection
  • Intrusion detection
  • Signature matching
  • Vulnerability signature

ASJC Scopus subject areas

  • Software
  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'NetShield: Massive semantics-based vulnerability signature matching for high-speed networks'. Together they form a unique fingerprint.

  • Cite this