{'fraction_non_alphanumeric': 0.013052208835341365, 'fraction_numerical': 0.0030120481927710845, 'mean_word_length': 5.154320987654321, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Approximate Packet Pre-filtering to Accelerate Pattern Matching

Intrusion detection system is a promising technique to improve Internet security. A daunting challenge in the design of this system is the requirement of simultaneous matching of hundreds to thousands of attack patterns at full wire speed. This paper presents a novel scheme to accelerate pattern matching by adding a prefilter to the exact pattern matching engines. This prefilter serves as a fast path for the majority incoming packets, which dramatically reduces the workload of exact pattern matching engines. Our prefilter checks each packet based on its header and content. To reduce matching complexity, the prefilter uses a much smaller set of representatives than the set of patterns. Our prefilter is false negative free, with a possible false positive rate, which can be reduced by increasing the representative length. Experiment results show that our prefilter has improved system throughput in the order of 100 times.