skip to main content
10.1145/1177080.1177121acmconferencesArticle/Chapter ViewAbstractPublication PagesimcConference Proceedingsconference-collections
Article

Efficient sequence alignment of network traffic

Published: 25 October 2006 Publication History

Abstract

String comparison algorithms, inspired by methods used in bioinformatics, have recently gained popularity in network applications. In this paper we demonstrate the need for careful selection of alignment models if such algorithms are to yield the desired results when applied to network traffic. We introduce a novel variant of the Jacobson-Vo algorithm employing a flexible gap-minimising alignment model suitable for network traffic, and find that our software implementation outperforms the commonly used Smith-Waterman approach by a factor of 33 on average and up to 58.5 in the best case on a wide range of network protocols.

References

[1]
James Newsome, Brad Karp, and Dawn Song. Polygraph: Automatically generating signatures for polymorphic worms. In Proc. 2005 IEEE Symposium on Security and Privacy, pages 226--241, Washington, DC, USA, 2005. IEEE Computer Society.
[2]
Christian Kreibich and Jon Crowcroft. Honeycomb - creating intrusion detection signatures using honeypots. In Proceedings of the Second Workshop on Hot Topics in Networks (Hotnets II), Boston, November 2003.
[3]
W. Cui, V. Paxson, N. Weaver, and R. H. Katz. Protocol-independent adaptive replay of application dialog. In 13th Annual Network and Distributed System Security Symposium (NDSS), San Diego, USA, February 2006.
[4]
J. Ma, K. Levchenko, C. Kreibich, S. Savage, and G. Voelker. Unexpected means of identifying protocols. In Proceedings of the Internet Measurement Conference. SIGCOMMUSENIX, October 2006.
[5]
H.-A. Kim and B. Karp. Autograph: Toward automated, distributed worm signature detection. In Proceedings of the 13th Usenix Security Symposium, San Diego, CA, 2004.
[6]
Sumeet Singh, Cristian Estan, George Varghese, and Stefan Savage. Automated worm fingerprinting. In Proceedings of the ACMUSENIX Symposium on Operating System Design and Implementation, Dec 2004.
[7]
S. B. Needleman and C. D. Wunsch. A general method applicable to the search for similarities in the amino acid sequence of two proteins. Journal of Molecular Biology, 48:443--453, 1970.
[8]
Dan Gusfield. Algorithms on Strings, Trees and Sequences. Cambridge University Press, 1997.
[9]
Temple F. Smith and Michael S. Waterman. Identification of common molecular subsequences. Journal of Molecular Biology, 147, 1981.
[10]
R. Durbin, S. Eddy, A. Krogh, and G. Mitchison. Biological Sequence Analysis. Cambridge University Press, 1998.
[11]
G. Jacobson and K. P. Vo. Heaviest increasing/common subsequence problems. In Proc. of the 3rd Symposium on Combinatorial Pattern Matching, volume 644, pages 52--65. Springer LNCS, 1992.
[12]
P. Pevzner and M. Waterman. Matrix longest common subsequence problem, duality and Hilbert bases. In Proc. of the 3rd Symposium on Combinatorial Pattern Matching, volume 644, pages 79--89. Springer LNCS, 1992.
[13]
Vern Paxson. Bro: A system for detecting network intruders in real-time. Computer Networks (Amsterdam, Netherlands: 1999), 31(23-24):2435--2463, 1998.

Cited By

View all
  • (2016)Fast Detection of Transformed Data LeaksIEEE Transactions on Information Forensics and Security10.1109/TIFS.2015.250327111:3(528-542)Online publication date: 1-Mar-2016
  • (2015)Social Friend Recommendation Based on Network Correlation and Feature Co-ClusteringProceedings of the 5th ACM on International Conference on Multimedia Retrieval10.1145/2671188.2749325(315-322)Online publication date: 22-Jun-2015
  • (2015)Rapid and parallel content screening for detecting transformed data exposure2015 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS)10.1109/INFCOMW.2015.7179383(191-196)Online publication date: Apr-2015
  • Show More Cited By

Index Terms

  1. Efficient sequence alignment of network traffic

    Recommendations

    Comments

    Information & Contributors

    Information

    Published In

    cover image ACM Conferences
    IMC '06: Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
    October 2006
    356 pages
    ISBN:1595935614
    DOI:10.1145/1177080
    Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

    Sponsors

    Publisher

    Association for Computing Machinery

    New York, NY, United States

    Publication History

    Published: 25 October 2006

    Permissions

    Request permissions for this article.

    Check for updates

    Author Tags

    1. sequence alignment
    2. sequence analysis
    3. traffic monitoring

    Qualifiers

    • Article

    Conference

    IMC06
    Sponsor:
    IMC06: Internet Measurement Conference
    October 25 - 27, 2006
    Rio de Janeriro, Brazil

    Acceptance Rates

    Overall Acceptance Rate 277 of 1,083 submissions, 26%

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • Downloads (Last 12 months)9
    • Downloads (Last 6 weeks)0
    Reflects downloads up to 02 Mar 2025

    Other Metrics

    Citations

    Cited By

    View all
    • (2016)Fast Detection of Transformed Data LeaksIEEE Transactions on Information Forensics and Security10.1109/TIFS.2015.250327111:3(528-542)Online publication date: 1-Mar-2016
    • (2015)Social Friend Recommendation Based on Network Correlation and Feature Co-ClusteringProceedings of the 5th ACM on International Conference on Multimedia Retrieval10.1145/2671188.2749325(315-322)Online publication date: 22-Jun-2015
    • (2015)Rapid and parallel content screening for detecting transformed data exposure2015 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS)10.1109/INFCOMW.2015.7179383(191-196)Online publication date: Apr-2015
    • (2011)Comparing files using structural entropyJournal in Computer Virology10.1007/s11416-011-0153-97:4(259-265)Online publication date: 1-Nov-2011
    • (2008)Privacy oracleProceedings of the 15th ACM conference on Computer and communications security10.1145/1455770.1455806(279-288)Online publication date: 27-Oct-2008
    • (2008)Network Traffic Classification by Common Subsequence FindingProceedings of the 8th international conference on Computational Science, Part I10.1007/978-3-540-69384-0_55(499-508)Online publication date: 23-Jun-2008
    • (2007)On web browsing privacy in anonymized NetFlowsProceedings of 16th USENIX Security Symposium on USENIX Security Symposium10.5555/1362903.1362926(1-14)Online publication date: 6-Aug-2007

    View Options

    Login options

    View options

    PDF

    View or Download as a PDF file.

    PDF

    eReader

    View online with eReader.

    eReader

    Figures

    Tables

    Media

    Share

    Share

    Share this Publication link

    Share on social media