Over the past decades, the web is always one of the most popular targets of hackers. Today, along with the popular usage of open sources such as Wordpress and Joomla, the explosion of the vulnerabilities in such frameworks causes the websites using them to face numerous security threats. Unfortunately, many clients and small companies may not be aware of these serious security threats and call a rescuer only when the website is hacked, compromised, or blocked by the search engines. In this paper, we present an effective counter against such threats, including monetization attempts in the less valuable targets such as small websites.

Preventing the attempts of abusing cheap-hosting Web-servers for monetization attacks

The invention relates to a Twins method for accelerating regular expression matching of compression flow. The core component is a compression flow Twins matching engine and comprises three processingmodules including a decoding module, a Twins matching algorithm and a finite state automaton as well as state record data required in a processing process; the compression flow Twins matching engine constructs the finite state automaton based on a to-be-matched regular expression, the compression flow byte content is then decoded, matching is conducted with the Twins matching algorithm finally, and a matching result is output; the text string scanned and decoded by the finite state automaton is adopted by the Twins matching algorithm, and encoded character string is processed with the Twins algorithm. The throughput rate of regular matching of compression flow is effectively improved under the condition of ensuring the same matching result as the Naive method, and the method is high in matching speed, convenient to implement and high in expansibility.

Twins method for accelerating regular expression matching of compression flow

Efficient regular expression matching over compressed traffic

Efficient regular expression matching over hybrid dictionary-based compressed data

The invention discloses a compressed flow mode matching engine and mode matching method based on an FPGA platform, designs an efficient implementation scheme based on the FPGA platform, and achieves the effect of accelerating matching of compressed flow. A compressed flow pattern matching engine based on an FPGA platform comprises four data storage function modules including an input queue, an output queue, a ring storage area and a result record, a matching module and a data carrying, reading and writing module. According to the technical scheme, the throughput rate when the engine processesthe compressed flow can be increased, and the processing time delay is effectively reduced.

Compressed flow pattern matching engine and pattern matching method based on FPGA platform

Nowadays, Deep Packet Inspection (DPI) becomes a critical component of the network traffic detection applications. For comprehensive analysis of traffic, regular expression matching as the core technique of DPI is widely used. However, web services tend to compress their traffic for less data transmission, which challenges the regular expression matching to achieve wire-speed processing. In this paper, we propose Twins, a fast regular expression matching method over compressed traffic that leverages the returned states encoding in the compression to skip the bytes to be scanned. In our evaluation results, Twins can skip about 90% compression data and can achieve 1.5Gbps throughput, which gains 2.7∼3.4 performance boost to the state-of-the-art work.

Towards a Fast Regular Expression Matching Method Over Compressed Traffic

In network measurement, many statistics counters need maintaining on the switch and thus consuming a lot of very precious on-chip memory. In fact, most network flows in the Internet are small flows that don't need large-width counters. In this paper, we present DIAL, a distributed counting approach, which duplicates the counting rules to leverage global memory resources, maximizing the counting efficiency, which is complementary to existing counter solutions. We pose and formulate the problem of finding the optimal placement for duplicated counting rules. After proving its NP hardness, we give some heuristics to fast generate a near-optimal placement. After describing the feasibility of implementation, we carry out some evaluation for DIAL. Our simulated results with Internet traffic and topologies show that DIAL can significantly decrease the memory cost and increase the memory efficiency for both fixed-width and variable-width counter architecture, with acceptable extra overheads, which is a great save of the precious high-speed memory in the switch.

Zheng Peng

Papers

Towards a Fast Regular Expression Matching Method Over Compressed Traffic

Efficient regular expression matching over compressed traffic

DIAL: Distributed Elephant Flow Counting on SDN