{"id":"https://openalex.org/W2085878512","doi":"https://doi.org/10.1109/infcom.2010.5462152","title":"Scalable NIDS via Negative Pattern Matching and Exclusive Pattern Matching","display_name":"Scalable NIDS via Negative Pattern Matching and Exclusive Pattern Matching","publication_year":2010,"publication_date":"2010-03-01","ids":{"openalex":"https://openalex.org/W2085878512","doi":"https://doi.org/10.1109/infcom.2010.5462152","mag":"2085878512"},"language":"en","primary_location":{"id":"doi:10.1109/infcom.2010.5462152","is_oa":false,"landing_page_url":"https://doi.org/10.1109/infcom.2010.5462152","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2010 Proceedings IEEE INFOCOM","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100603979","display_name":"Kai Zheng","orcid":"https://orcid.org/0000-0002-0217-3998"},"institutions":[{"id":"https://openalex.org/I4210126794","display_name":"IBM Research (China)","ror":"https://ror.org/02yg1pf55","country_code":"CN","type":"company","lineage":["https://openalex.org/I1341412227","https://openalex.org/I4210114115","https://openalex.org/I4210126794"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Kai Zheng","raw_affiliation_strings":["IBM China Research Laboratory, Beijing, China","IBM China Research Lab Beijing P.R. China"],"affiliations":[{"raw_affiliation_string":"IBM China Research Laboratory, Beijing, China","institution_ids":["https://openalex.org/I4210126794"]},{"raw_affiliation_string":"IBM China Research Lab Beijing P.R. China","institution_ids":["https://openalex.org/I4210126794"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051085669","display_name":"Xin Zhang","orcid":"https://orcid.org/0000-0002-0579-2268"},"institutions":[{"id":"https://openalex.org/I74973139","display_name":"Carnegie Mellon University","ror":"https://ror.org/05x2bcf33","country_code":"US","type":"education","lineage":["https://openalex.org/I74973139"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xin Zhang","raw_affiliation_strings":["Carnegie Mellon University, Pittsburgh, PA, USA","Carnegie-Mellon University, Pittsburgh, PA"],"affiliations":[{"raw_affiliation_string":"Carnegie Mellon University, Pittsburgh, PA, USA","institution_ids":["https://openalex.org/I74973139"]},{"raw_affiliation_string":"Carnegie-Mellon University, Pittsburgh, PA","institution_ids":["https://openalex.org/I74973139"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5006334685","display_name":"Zhiping Cai","orcid":"https://orcid.org/0000-0001-5726-833X"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhiping Cai","raw_affiliation_strings":["School of Computer, National University of Defense Technology, Changsha, China","[School of Computer, National University of Defense Technology, Changsha, P. R. China]"],"affiliations":[{"raw_affiliation_string":"School of Computer, National University of Defense Technology, Changsha, China","institution_ids":["https://openalex.org/I170215575"]},{"raw_affiliation_string":"[School of Computer, National University of Defense Technology, Changsha, P. R. China]","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100437368","display_name":"Zhijun Wang","orcid":"https://orcid.org/0009-0003-0835-8736"},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Zhijun Wang","raw_affiliation_strings":["Department of Computing, Hong Kong Polytechnic University, Hong Kong, China","Dep. of Computing, Hong Kong Polytechnic University, Hong Kong, P.R.China#TAB#"],"affiliations":[{"raw_affiliation_string":"Department of Computing, Hong Kong Polytechnic University, Hong Kong, China","institution_ids":["https://openalex.org/I14243506"]},{"raw_affiliation_string":"Dep. of Computing, Hong Kong Polytechnic University, Hong Kong, P.R.China#TAB#","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5042967628","display_name":"Baohua Yang","orcid":"https://orcid.org/0000-0001-5225-3104"},"institutions":[{"id":"https://openalex.org/I4210126794","display_name":"IBM Research (China)","ror":"https://ror.org/02yg1pf55","country_code":"CN","type":"company","lineage":["https://openalex.org/I1341412227","https://openalex.org/I4210114115","https://openalex.org/I4210126794"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Baohua Yang","raw_affiliation_strings":["IBM China Research Laboratory, Beijing, China","IBM China Research Lab Beijing P.R. China"],"affiliations":[{"raw_affiliation_string":"IBM China Research Laboratory, Beijing, China","institution_ids":["https://openalex.org/I4210126794"]},{"raw_affiliation_string":"IBM China Research Lab Beijing P.R. China","institution_ids":["https://openalex.org/I4210126794"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5100603979"],"corresponding_institution_ids":["https://openalex.org/I4210126794"],"apc_list":null,"apc_paid":null,"fwci":1.0108,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.78020649,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":96},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"9"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11478","display_name":"Caching and Content Delivery","score":0.9941999912261963,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8700383901596069},{"id":"https://openalex.org/keywords/speedup","display_name":"Speedup","score":0.8389761447906494},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.7379419803619385},{"id":"https://openalex.org/keywords/pattern-matching","display_name":"Pattern matching","score":0.6897956132888794},{"id":"https://openalex.org/keywords/correctness","display_name":"Correctness","score":0.6257345080375671},{"id":"https://openalex.org/keywords/parallel-computing","display_name":"Parallel computing","score":0.6175520420074463},{"id":"https://openalex.org/keywords/matching","display_name":"Matching (statistics)","score":0.4990255832672119},{"id":"https://openalex.org/keywords/partition","display_name":"Partition (number theory)","score":0.4880343973636627},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.452169269323349},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.43213406205177307},{"id":"https://openalex.org/keywords/regular-expression","display_name":"Regular expression","score":0.42771369218826294},{"id":"https://openalex.org/keywords/load-balancing","display_name":"Load balancing (electrical power)","score":0.4118228554725647},{"id":"https://openalex.org/keywords/algorithm","display_name":"Algorithm","score":0.26966243982315063},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.14895620942115784},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.13256585597991943}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8700383901596069},{"id":"https://openalex.org/C68339613","wikidata":"https://www.wikidata.org/wiki/Q1549489","display_name":"Speedup","level":2,"score":0.8389761447906494},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.7379419803619385},{"id":"https://openalex.org/C68859911","wikidata":"https://www.wikidata.org/wiki/Q1503724","display_name":"Pattern matching","level":2,"score":0.6897956132888794},{"id":"https://openalex.org/C55439883","wikidata":"https://www.wikidata.org/wiki/Q360812","display_name":"Correctness","level":2,"score":0.6257345080375671},{"id":"https://openalex.org/C173608175","wikidata":"https://www.wikidata.org/wiki/Q232661","display_name":"Parallel computing","level":1,"score":0.6175520420074463},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.4990255832672119},{"id":"https://openalex.org/C42812","wikidata":"https://www.wikidata.org/wiki/Q1082910","display_name":"Partition (number theory)","level":2,"score":0.4880343973636627},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.452169269323349},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.43213406205177307},{"id":"https://openalex.org/C121329065","wikidata":"https://www.wikidata.org/wiki/Q185612","display_name":"Regular expression","level":2,"score":0.42771369218826294},{"id":"https://openalex.org/C138959212","wikidata":"https://www.wikidata.org/wiki/Q1806783","display_name":"Load balancing (electrical power)","level":3,"score":0.4118228554725647},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.26966243982315063},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.14895620942115784},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.13256585597991943},{"id":"https://openalex.org/C187691185","wikidata":"https://www.wikidata.org/wiki/Q2020720","display_name":"Grid","level":2,"score":0.0},{"id":"https://openalex.org/C114614502","wikidata":"https://www.wikidata.org/wiki/Q76592","display_name":"Combinatorics","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.0},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/infcom.2010.5462152","is_oa":false,"landing_page_url":"https://doi.org/10.1109/infcom.2010.5462152","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2010 Proceedings IEEE INFOCOM","raw_type":"proceedings-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.210.6023","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.210.6023","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.cs.cmu.edu/%7Exzhang1/doc/Scalable_NIDS.pdf","raw_type":"text"},{"id":"pmh:oai:ira.lib.polyu.edu.hk:10397/19950","is_oa":false,"landing_page_url":"http://hdl.handle.net/10397/19950","pdf_url":null,"source":{"id":"https://openalex.org/S4306400205","display_name":"PolyU Institutional Research Archive (Hong Kong Polytechnic University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I14243506","host_organization_name":"Hong Kong Polytechnic University","host_organization_lineage":["https://openalex.org/I14243506"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Conference Paper"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":11,"referenced_works":["https://openalex.org/W1531610435","https://openalex.org/W1960511147","https://openalex.org/W2011546099","https://openalex.org/W2095646789","https://openalex.org/W2103830109","https://openalex.org/W2116967744","https://openalex.org/W2137559158","https://openalex.org/W2138729491","https://openalex.org/W2171421880","https://openalex.org/W6631793881","https://openalex.org/W6680581150"],"related_works":["https://openalex.org/W1774017438","https://openalex.org/W2123199373","https://openalex.org/W4246925412","https://openalex.org/W2083577879","https://openalex.org/W4205780093","https://openalex.org/W2100501061","https://openalex.org/W2109464334","https://openalex.org/W2377397587","https://openalex.org/W2031647786","https://openalex.org/W2386564085"],"abstract_inverted_index":{"In":[0],"this":[1,68],"paper,":[2],"we":[3,70,110],"identify":[4],"the":[5,56,73,85,95,112,120,138,147,158,172],"unique":[6],"challenges":[7],"in":[8,41,103,187],"deploying":[9],"parallelism":[10,29,40],"on":[11],"TCAM-based":[12],"pattern":[13,32,122,159],"matching":[14,33,160],"for":[15,31],"Network":[16],"Intrusion":[17],"Detection":[18],"Systems":[19],"(NIDSes).":[20],"We":[21,140],"resolve":[22],"two":[23,174],"critical":[24],"issues":[25],"when":[26],"designing":[27],"scalable":[28],"specifically":[30],"modules:":[34],"1)":[35],"how":[36,53],"to":[37,54,80,118,183],"enable":[38],"fine-grained":[39],"pursuit":[42],"of":[43,76,87,114,149],"effective":[44],"load":[45],"balancing":[46],"and":[47,51,62,94,134,151,155,162,167],"desirable":[48],"speedup":[49,61],"simultaneously;":[50],"2)":[52],"reconcile":[55],"tension":[57],"between":[58],"parallel":[59,104],"processing":[60],"prohibitive":[63],"TCAM":[64,88,153],"power":[65],"consumption.":[66],"To":[67],"end,":[69],"first":[71],"propose":[72,111],"novel":[74],"concept":[75],"Negative":[77],"Pattern":[78,116,144],"Matching":[79,117,145],"partition":[81],"flows,":[82],"by":[83],"which":[84,127],"number":[86],"lookups":[89],"can":[90,100,128],"be":[91,101,130],"significantly":[92],"reduced,":[93],"resulting":[96],"(fine-grained)":[97],"flow":[98],"segments":[99],"inspected":[102],"without":[105,136],"incurring":[106],"false":[107],"negatives.":[108],"Then":[109],"notion":[113],"Exclusive":[115,143],"divide":[119],"entire":[121],"set":[123],"into":[124],"multiple":[125],"subsets":[126],"later":[129],"matched":[131],"against":[132],"selectively":[133],"independently":[135],"affecting":[137],"correctness.":[139],"show":[141],"that":[142,171],"enables":[146],"adoption":[148],"smaller":[150],"faster":[152],"blocks":[154],"improves":[156],"both":[157],"speed":[161],"scalability.":[163],"Finally,":[164],"our":[165,180],"theoretical":[166],"experimental":[168],"results":[169],"validate":[170],"above":[173],"concepts":[175],"are":[176],"inherently":[177],"complementary,":[178],"enabling":[179],"integrated":[181],"scheme":[182],"provide":[184],"performance":[185],"gain":[186],"any":[188],"scenario":[189],"(with":[190],"either":[191],"clean":[192],"or":[193],"dirty":[194],"traffic).":[195]},"counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2014,"cited_by_count":1},{"year":2013,"cited_by_count":2},{"year":2012,"cited_by_count":2}],"updated_date":"2026-04-05T17:49:38.594831","created_date":"2025-10-10T00:00:00"}