Improving false positive in Bloom filter

Bloom filter is a space-efficient data structure used for supporting membership queries, e.g. pattern matching. Bloom filter is used in many network processing applications. For instance, in today´s internet, viruses, worms and network intruders cause service damages with enormous economic impact. In many security systems, such as intrusion detection systems we need to inspect packets´ header and payload for predefined strings (called signatures) to detect malicious packets. Pattern matching process is usually deployed in routers and should keep pace with high network speed. Therefore pattern matching algorithms may become critical bottleneck in intrusion detection systems. Hence hardware-based techniques like Bloom filter are preferred rather than software-based solutions, to meet the performance goals. In this paper we describe a technique to improve Bloom filter performance. Simulation results and analysis show that false alarms decrease significantly using this technique.