Pattern matching technique on fragmented and Out-of-Order packet streams for Intrusion Detection System

Fragmentation is the term given to the process of breaking down an IP datagram into smaller packets to be transmitted over different types of network media and then reassembling them at the other end. In most cases, depending upon the actual security device defending the network, there are typically multiple fragmentation techniques and packet size combinations capable of squeezing and exploiting protection device on a network. In this paper we present an efficient algorithm for regular expression matching on streams with fragmented and out of order data, while maintaining a small state and without complete stream reconstruction. It improves the performance of Intrusion Detection System for detecting the fragmented and Out-of-Order packet attack.