Abstract:
We develop a method to compress the unoptimized Aho-Corasick automaton that is used widely in intrusion detection systems. Our method uses bitmaps with multiple levels of...Show MoreMetadata
Abstract:
We develop a method to compress the unoptimized Aho-Corasick automaton that is used widely in intrusion detection systems. Our method uses bitmaps with multiple levels of summaries as well as aggressive path compaction. By using multiple levels of summaries, we are able to determine a popcount with as few as 1 addition. On Snort string databases, our compressed automata take 24% to 31% less memory than taken by the compressed automata of Tuck et al. [23]. and the number of additions required to compute popcounts is reduced by about 90%.
Published in: 2008 IEEE Symposium on Computers and Communications
Date of Conference: 06-09 July 2008
Date Added to IEEE Xplore: 16 September 2008
ISBN Information:
Print ISSN: 1530-1346