Processing of multi-pattern signature in intrusion detection system with content processor

Content processor refers to the hardware accelerator for pattern matching which is essential for network security appliances such as intrusion detection system. With the deployment of high-speed network, its use has been increased to detect malicious attacks in the packet stream in real time. In this paper we introduce an efficient algorithm for content processor to perform multi-pattern signature matching. The proposed algorithm uses software bitmap for each multi-pattern signature without hardware changes, which maximizes flexibility of content processor. From the analysis of Snort which is the widely used intrusion detection system, we observe spatial locality between distances of patterns in the multi-pattern signature. The algorithm makes use of this distance information for adaptive performance optimization. Our techniques show that content processor can be used for multi-pattern processing in intrusion detection systems without hardware modification with reasonable performance.