Logo image
Fast Pattern Detection in Stream Data
Thesis

Fast Pattern Detection in Stream Data

Chang-Yeng Cheng
Masters, 國立清華大學, 資訊工程學系
2003

Abstract

串流資料 數位污染 字串比對 入侵偵測 決策樹 data stream digital pollution string matching intrusion detection decision tree
Digital pollution is emerging as an overwhelming threat to the Internet, whose ubiquitous connectivity conversely cultivates the widespread outbreaks of such dirt. Considerable amount of human efforts and network resources are wasted at a little cost of the few polluters. To prevent flooding of the contamination, classical string matching schemes and their variants can be the first aid for the effective quarantine to establish its censorship. The features of the typical pollutants are extracted and refined into so-called signatures. Every transfer post then looks through the incoming stream data for these signatures. Upon detecting any such pattern, the post can obstruct the connection and sound an alert to inform higher-level security systems. Obviously, the processing speed and accuracy of pattern detection schemes is crucial to the effectiveness of security systems. To expedite the scrutiny, we propose a novel pattern detection technique based on the decision tree induction to seek for significant improvement over the classical schemes. According to the intrinsic of the pattern, the tree is sprouted adaptively to minimize the number of symbols in the data stream needed to be examined. This allows a unique order to inspect the symbols in a strategic way optimized contextually, as opposed to the fixed order followed by the other schemes. In other words, this strategy inspects the symbols in every possible matching positions in parallel, and rules out the unmatching ones that have at least one false matching symbol. Finally only the possible positions that match the previous inspected symbols needed to be checked with the entire pattern. This way reduces considerable amounts of context symbol checks to confirm a matching. Performance study indicates our approach achieves the speed-up of five or more over the best competitors.

Metrics

1 Record Views

Details

Logo image