A Stream Pattern Matching Method for Traffic Analysis

作者：Zhu Hui^*; Li Hui; Mo Can

来源：China Communications, 2010, 7(6): 86-93.

• traffic analysis
• stream pattern match
• non-finite automata
• bit-parallel

In order to identify any traces of suspicious activities for the networks security, Network Traffic Analysis has been the basis of network security and network management. With the continued emergence of new applications and encrypted traffic, the currently available approaches can not perform well for all kinds of network data. In this paper, we propose a novel stream pattern matching technique which is not only easily deployed but also includes the advantages of different methods. The main idea is: first, defining a formal description specification, by which any series of data stream can be unambiguously described by a special stream pattern; then a tree representation is constructed by parsing the stream pattern; at last, a stream pattern engine is constructed with the Non-finite automata (S-CG-NFA) and Bit-parallel searching algorithms. Our stream pattern analysis system has been fully prototyped on C programming language and Xilinx Virtex2 FPGA. The experimental results show the method could provides a high level of recognition efficiency and accuracy.

• 出版日期2010-12
• 单位西安电子科技大学