Acceptable Quality-of-Information (QoI) is essential for sensor network applications such as infrastructure health monitoring because it directly impacts public safety. However, it is a challenging problem to attain good QoI of sensor applications due to unpredictable environment noise, unreliable network communication, and varying requirements for wide variety of sensor applications. We believe the first step to addressing this challenge is to develop an application-independent QoI model. In this paper, we present a fundamental quality-of-information model based on signal-to-noise ratio. Our model addresses information quality by considering sensor measurement quality, network quality and sensor application requirements by end users. Furthermore, we develop a quality-aware scheduling framework which exploits an analytical queue model to calculate and adapt sensor node sampling rate and base station scheduling priority in order to optimize overall quality. Our results show that sensor measurement quality in terms of sampling rate, network quality in terms of loss rate and delay, all play significant roles in impacting overall quality. A QoI-aware scheduler thus is an effective approach to quantify information quality and adapt for unpredictable sensor networks.

As network speeds continue to increase, so does the need for scalable pattern matching for deep packet scanning applications such as signature-based network intrusion detection. Multiple-stride deterministic finite automaton (DFA) increases the performance of pattern matching, because they allow multiple bytes of a packet to be scanned simultaneously. However, traditional multiple-stride DFA either rely on specific hardware for parallel comparison or have a huge memory requirements due to state explosion. In this paper, we present a high throughput, multiple-stride pattern-matching architecture that requires a small storage cost and no specific hardware. The basic idea is to group DFA states/transitions into three coarse-grained and variable-size blocks, so that each individual block can employ different-specific methods to optimize storage requirements and performance. The blocks are naturally identified based on basic observations of DFA characteristics: prefix, linear trie and state dependencies. The performance evaluation is done using the Snort pattern sets. We show that multi-byte striding DFA achieves multi Gb/s pure content inspection in software, while utilizing <3 bytes per pattern character.

Abstract Intrusion Detection Systems (IDSs) rely on pattern matching to detect and thwart a network attack by comparing packets with a database of known attack patterns. The key requirements of trusted intrusion detection are accurate pattern matching, adaptive, and reliable reconfiguration for new patterns. To address these requirements, this paper presents a trusted intrusion detection by utilizing hybrid pattern matching engines: FPGA‐based and multicore‐based pattern matching engine. To achieve synchronization of these two pattern matching engines, methodologies including multi‐threading DFA and clustered state coding have been developed. These hybrid pattern matching engines increases the reliability and trustworthy of intrusion detection systems. Copyright © 2009 John Wiley & Sons, Ltd.

Memory-based Deterministic Finite Automata (DFA) are ideal for pattern matching in network intrusion detection systems due to their deterministic performance and ease of update of new patterns, however severe DFA memory requirements make it impractical to implement thousands of patterns. This article aims to understand the basic relationship between DFA characteristics and memory requirements, and to design a practical memory-based pattern matching engine. We present a methodology that consists of theoretical DFA characterization, encoding optimization, and implementation architecture. Results show the validity of the characterization metrics, effectiveness of the encoding techniques, and efficiency of the memory-based pattern engines.

Quality of service in sensor networks is a difficult problem due to unpredictable environment noise, unreliable network communication and varying requirements for wide varieties of applications. In this paper, we present fundamental quality of information metrics using signal-to-noise ratio. These metrics address information quality under varying sensing environments, noise and network bandwidth, and are completely application independent. We use these metrics to develop a quality-aware scheduling system (QSS) which exploits cross-layer control of sensors to effectively schedule data sensing and forwarding. Particularly, we develop and evaluate several QSS scheduling mechanisms: passive, reactive and perceptive. These mechanisms can adapt to environment noise and bandwidth variation by dynamically changing sensor rates. Our results indicate that our QSS is a novel and effective approach to improve the QoS for sensor networks.

Dangerous worms like CodeRed or Slammer can spread millions of probe packets in just seconds which can result in thousands of infected hosts and large losses. Fast and effective containment strategies are crucially important to protect the Internet Infrastructure. Toward this goal of fast and effective worm containment, different techniques have been presented such as address blacklisting and content filtering [3], anomaly detection [6] and signature-based detection [5]. Meanwhile recently developed worm models [1] enable us to develop a testbed to accurately and quickly evaluate the efficiency of these defense mechanisms. In this paper, we present a testbed which utilizes software agents to allow large scale simulation with individual host functionality. We utilize this testbed to evaluate our containment systems in terms of security and performance tradeoff.

In the midst of vastly numbered and quickly growing internet security threats, Network Intrusion Detection System (NIDS) [2] becomes more important to network security every day. Vital to effective NIDS is a multi-pattern matching engine which requires deterministic performance and adaptability to new threats [3]. Memory-based Deterministic Finite Automata (DFA) are ideal for pattern matching but have severe memory requirements [1] that make them difficult to implement. Many previous heuristic techniques have been proposed to reduce memory requirements, however in this paper, we aim to effectively understand the basic relationship between DFA characteristics and memory, in order to create minimal memory DFA implementations. We show what DFA characteristics either cause or reduce memory requirements, as well as how to optimize DFA to exploit those characteristics. Specifically, we introduce the concepts of State Independence and State Irregularity, which are DFA characteristics that can reduce memory waste and allow for memory reuse. Furthermore, we introduce DFA normalization which optimizes DFA to fully exploit these characteristics. Altogether this work serves as a source for how to extract and utilize DFA characteristics to create minimal memory implementations.

Signature-based network intrusion detection requires fast and reconfigurable pattern matching for deep packet inspection. In our previous work we address this problem with a hardware based pattern matching engine that utilizes a novel state encoding scheme to allow memory efficient use of Deterministic Finite Automata. In this work we expand on these concepts to create a completely software based system, P3FSM, which combines the properties of hardware based systems with the portability and programmability of software. Specifically we introduce two methods, character aware and SDFA, for encoding predictive state codes which can forecast the next states of our FSM. The result is software based pattern matching which is fast, reconfigurable, memory-efficient and portable.