California State University, Northridge Pattern
Total Page:16
File Type:pdf, Size:1020Kb
CALIFORNIA STATE UNIVERSITY, NORTHRIDGE PATTERN MATCHING ALGORITHMS FOR INTRUSION DETECTION SYSTEMS A Thesis submitted in partial fulfillment of the requirements For the degree of Master of Science In Computer Science By Stanimir Bogomilov Belchev August 2012 The thesis of Stanimir Bogomilov Belchev is approved: _____________________________________ _________________ Prof. John Noga Date _____________________________________ _________________ Prof. Robert McIlhenny Date _____________________________________ _________________ Prof. Jeff Wiegley, Chair Date California State University, Northridge ii DEDICATION I dedicate this paper to my parents, family, and friends for their continuous support throughout the years. I am grateful they continuously prompted me to go back to school and continue to educate myself – this has helped me a lot in life. I also want to thank my girlfriend (and future wife) Nadia for always staying by my side and supporting me every step of the way. Her passions for science has had a great impact on me and prompted me to explore subjects that I wouldn’t think would be interesting to me anyways. Thank you!!! iii ACKNOWLEDGEMENTS I would like to thank the Computer Science department at California State University Northridge for their help and support. Especially I would like to thank my committee members – Prof. Jeff Wiegley (chair), Prof. Robert McIlhenny, and Prof. John Noga. I admire their passion to computing and their dedication to teaching their students. My stay at California State University Northridge was an invaluable experience that gave me inspiration, knowledge, and love towards computing. Every class was fun and exciting, even when I had to do my homework late at night. The staff and faculty and the Computer Science department was professional and very knowledgeable and they certainly helped me grow as an individual. Thank you all! iv TABLE OF CONTENTS Signature Page .......................................................................................................................... ii Dedication ................................................................................................................................ iii Acknowledgements .................................................................................................................. iv List of Tables ........................................................................................................................... vi List of Figures ......................................................................................................................... vii List of Algorithms .................................................................................................................. viii Glossary of Acronyms ............................................................................................................. ix Abstract .................................................................................................................................... xi Chapter 1: Introduction ..............................................................................................................1 Chapter 2: Overview of Intrusion Detection Systems ...............................................................4 2.1 Firewall versus IDS........................................................................................................5 2.2 Passive versus Reactive IDSs ........................................................................................6 2.3 Network-based versus Host-based IDSs ........................................................................7 2.4 Distributed IDSs...........................................................................................................10 2.5 Signature-based versus Anomaly-based Detection ......................................................12 2.6 Wireless IDSs...............................................................................................................14 2.7 IDSs Software Implementations ..................................................................................16 Chapter 3: Snort Intrusion Detection System ..........................................................................18 3.1 Overview of Snort IDS ................................................................................................19 3.2 Snort Architecture ........................................................................................................22 v 3.3 Snort Rules ...................................................................................................................21 Chapter 4: Traits of Pattern Matching Algorithms ..................................................................28 4.1 Overview of Pattern Matching .....................................................................................28 4.2 Signature Set Size ........................................................................................................30 4.3 Alphabet Size ...............................................................................................................31 4.4 Keywords Length .........................................................................................................32 4.5 Computational Complexity ..........................................................................................34 Chapter 5: Single-Keyword Pattern Matching Algorithms .....................................................38 5.1 Brute Force (BF) Algorithm ........................................................................................39 5.2 Knuth-Morris-Prath (KMP) Algorithm........................................................................42 5.3 Boyer-Moore (BM) Algorithm ....................................................................................47 5.4 Karp and Rabin Algorithm...........................................................................................55 Chapter 6: Multiple-Keyword Pattern Matching Algorithms ..................................................60 6.1 Aho-Corasick (AC) Algorithm ....................................................................................60 6.2 Wu-Manber (WB) Algorithm ......................................................................................66 6.3 Commentz-Walter (CW) Algorithm ............................................................................69 Chapter 7: Conclusion..............................................................................................................57 Bibliography ............................................................................................................................58 vi LIST OF TABLES 5.2 Pre-computational table of the next function in the KMP algorithm.................................36 5.3 Pre-computation of the SHIFT table in the Boyer-Moore algorithm ................................42 6.2 Calculation of the min function in the Wu-Manber algorithm ..........................................57 6.2 SHIFT and HASH tables in the Wu-Manber algorithm ....................................................60 vii LIST OF FIGURES 2.3 A typical deployment of a Network Intrusion Detection System ........................................9 2.4 Distributed Intrusion Setection System .............................................................................11 3.2 Architecture of Snort IDS ..................................................................................................19 3.3 Sample Snort rule detecting attempts from a telnet session ..............................................21 4.4 Distribution of the string length in the Snort default database ..........................................28 4.5 Normal and worst-case operation of a hash table. .............................................................30 5.3 Example of Moyer Moore Pattern Matching Algorithm. ..................................................44 6.1 Keyword tree for P = {he, she, his, hers}. .........................................................................52 6.1 Example of Aho-Corasick automation ...............................................................................54 6.2 Relation between search time and the length of patterns in Wu-Manber algorithm .........62 6.3 Commentz-Walter keyword trie including both shift functions ........................................66 viii LIST OF ALGORITHMS 5.1 Java implementation of Brute Force algorithm .................................................................34 5.2 Knuth-Morris-Pratt Next Function ....................................................................................35 5.2 Knuth-Morris-Pratt Matching Algorithm ..........................................................................39 5.3 Boyer-Moore bad character pre-processing .......................................................................44 5.3 Pseudo Code of Boyer-Moore Algorithm. .........................................................................45 5.4 Pseudo code for Karp-Rabin string matching algorithm ...................................................49 6.1 Aho Corasick Goto Function. ............................................................................................54 6.1 Aho-Corasick Multiple Pattern Matching Algorithm. .......................................................55 6.2 Pseudo-code of Wu-Manber algorithm. .............................................................................63 6.3 Commentz-Walter multiple pattern-matching algorithm pseudo-code.