{"id":"https://openalex.org/W2126846158","doi":"https://doi.org/10.1109/mnet.2009.4804321","title":"Counting bloom filters for pattern matching and anti-evasion at the wire speed","display_name":"Counting bloom filters for pattern matching and anti-evasion at the wire speed","publication_year":2009,"publication_date":"2009-01-01","ids":{"openalex":"https://openalex.org/W2126846158","doi":"https://doi.org/10.1109/mnet.2009.4804321","mag":"2126846158"},"language":"en","primary_location":{"id":"doi:10.1109/mnet.2009.4804321","is_oa":false,"landing_page_url":"https://doi.org/10.1109/mnet.2009.4804321","pdf_url":null,"source":{"id":"https://openalex.org/S186584794","display_name":"IEEE Network","issn_l":"0890-8044","issn":["0890-8044","1558-156X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Network","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5024205614","display_name":"Gianni Antichi","orcid":"https://orcid.org/0000-0002-6063-4975"},"institutions":[{"id":"https://openalex.org/I108290504","display_name":"University of Pisa","ror":"https://ror.org/03ad39j10","country_code":"IT","type":"education","lineage":["https://openalex.org/I108290504"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Gianni Antichi","raw_affiliation_strings":["University of Pisa, Italy","Dept. of Inf. Eng., Univ. of Pisa., Pisa"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Pisa, Italy","institution_ids":["https://openalex.org/I108290504"]},{"raw_affiliation_string":"Dept. of Inf. Eng., Univ. of Pisa., Pisa","institution_ids":["https://openalex.org/I108290504"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5056667178","display_name":"Domenico Ficara","orcid":"https://orcid.org/0009-0009-0203-331X"},"institutions":[{"id":"https://openalex.org/I108290504","display_name":"University of Pisa","ror":"https://ror.org/03ad39j10","country_code":"IT","type":"education","lineage":["https://openalex.org/I108290504"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Domenico Ficara","raw_affiliation_strings":["University of Pisa, Italy","Dept. of Inf. Eng., Univ. of Pisa., Pisa"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Pisa, Italy","institution_ids":["https://openalex.org/I108290504"]},{"raw_affiliation_string":"Dept. of Inf. Eng., Univ. of Pisa., Pisa","institution_ids":["https://openalex.org/I108290504"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108084997","display_name":"Stefano Giordano","orcid":null},"institutions":[{"id":"https://openalex.org/I108290504","display_name":"University of Pisa","ror":"https://ror.org/03ad39j10","country_code":"IT","type":"education","lineage":["https://openalex.org/I108290504"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Stefano Giordano","raw_affiliation_strings":["University of Pisa, Italy","Dept. of Inf. Eng., Univ. of Pisa., Pisa"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Pisa, Italy","institution_ids":["https://openalex.org/I108290504"]},{"raw_affiliation_string":"Dept. of Inf. Eng., Univ. of Pisa., Pisa","institution_ids":["https://openalex.org/I108290504"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051501620","display_name":"Gregorio Procissi","orcid":"https://orcid.org/0000-0001-5604-6129"},"institutions":[{"id":"https://openalex.org/I108290504","display_name":"University of Pisa","ror":"https://ror.org/03ad39j10","country_code":"IT","type":"education","lineage":["https://openalex.org/I108290504"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Gregorio Procissi","raw_affiliation_strings":["University of Pisa, Italy","Dept. of Inf. Eng., Univ. of Pisa., Pisa"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Pisa, Italy","institution_ids":["https://openalex.org/I108290504"]},{"raw_affiliation_string":"Dept. of Inf. Eng., Univ. of Pisa., Pisa","institution_ids":["https://openalex.org/I108290504"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5070487616","display_name":"Fabio Vitucci","orcid":null},"institutions":[{"id":"https://openalex.org/I108290504","display_name":"University of Pisa","ror":"https://ror.org/03ad39j10","country_code":"IT","type":"education","lineage":["https://openalex.org/I108290504"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Fabio Vitucci","raw_affiliation_strings":["University of Pisa, Italy","Dept. of Inf. Eng., Univ. of Pisa., Pisa"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Pisa, Italy","institution_ids":["https://openalex.org/I108290504"]},{"raw_affiliation_string":"Dept. of Inf. Eng., Univ. of Pisa., Pisa","institution_ids":["https://openalex.org/I108290504"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I108290504"],"apc_list":null,"apc_paid":null,"fwci":1.5815,"has_fulltext":false,"cited_by_count":17,"citation_normalized_percentile":{"value":0.84294407,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":98},"biblio":{"volume":"23","issue":"1","first_page":"30","last_page":"35"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/bloom-filter","display_name":"Bloom filter","score":0.9034497737884521},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8559131622314453},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.750481367111206},{"id":"https://openalex.org/keywords/deep-packet-inspection","display_name":"Deep packet inspection","score":0.6734576225280762},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.6714274287223816},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.6165352463722229},{"id":"https://openalex.org/keywords/evasion","display_name":"Evasion (ethics)","score":0.5692989826202393},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.5343716740608215},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.507379949092865},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.48711395263671875},{"id":"https://openalex.org/keywords/string-searching-algorithm","display_name":"String searching algorithm","score":0.4758583903312683},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.4646555781364441},{"id":"https://openalex.org/keywords/network-processor","display_name":"Network processor","score":0.44227561354637146},{"id":"https://openalex.org/keywords/pattern-matching","display_name":"Pattern matching","score":0.43866661190986633},{"id":"https://openalex.org/keywords/wire-speed","display_name":"Wire speed","score":0.41004878282546997},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.32246702909469604},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.28086304664611816},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.11991989612579346}],"concepts":[{"id":"https://openalex.org/C147224247","wikidata":"https://www.wikidata.org/wiki/Q885373","display_name":"Bloom filter","level":2,"score":0.9034497737884521},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8559131622314453},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.750481367111206},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.6734576225280762},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.6714274287223816},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.6165352463722229},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.5692989826202393},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5343716740608215},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.507379949092865},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.48711395263671875},{"id":"https://openalex.org/C7757238","wikidata":"https://www.wikidata.org/wiki/Q374040","display_name":"String searching algorithm","level":3,"score":0.4758583903312683},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.4646555781364441},{"id":"https://openalex.org/C74366991","wikidata":"https://www.wikidata.org/wiki/Q2755335","display_name":"Network processor","level":3,"score":0.44227561354637146},{"id":"https://openalex.org/C68859911","wikidata":"https://www.wikidata.org/wiki/Q1503724","display_name":"Pattern matching","level":2,"score":0.43866661190986633},{"id":"https://openalex.org/C46788351","wikidata":"https://www.wikidata.org/wiki/Q571379","display_name":"Wire speed","level":2,"score":0.41004878282546997},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.32246702909469604},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.28086304664611816},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.11991989612579346},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.0},{"id":"https://openalex.org/C203014093","wikidata":"https://www.wikidata.org/wiki/Q101929","display_name":"Immunology","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C8891405","wikidata":"https://www.wikidata.org/wiki/Q1059","display_name":"Immune system","level":2,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/mnet.2009.4804321","is_oa":false,"landing_page_url":"https://doi.org/10.1109/mnet.2009.4804321","pdf_url":null,"source":{"id":"https://openalex.org/S186584794","display_name":"IEEE Network","issn_l":"0890-8044","issn":["0890-8044","1558-156X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Network","raw_type":"journal-article"},{"id":"pmh:oai:arpi.unipi.it:11568/194388","is_oa":false,"landing_page_url":"http://hdl.handle.net/11568/194388","pdf_url":null,"source":{"id":"https://openalex.org/S4377196265","display_name":"CINECA IRIS Institutial research information system (University of Pisa)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I108290504","host_organization_name":"University of Pisa","host_organization_lineage":["https://openalex.org/I108290504"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/article"},{"id":"pmh:oai:bibcyt.ucla.edu.ve:T070300016047/4","is_oa":false,"landing_page_url":"http://bibcyt.ucla.edu.ve/cgi-win/be_alex.exe?Acceso=T070300016047/4&Nombrebd=Bciucla","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320338370","display_name":"FP7 Information and Communication Technologies","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":15,"referenced_works":["https://openalex.org/W1490025813","https://openalex.org/W1553177637","https://openalex.org/W1580997674","https://openalex.org/W1998604113","https://openalex.org/W2099972273","https://openalex.org/W2104512969","https://openalex.org/W2110867253","https://openalex.org/W2116967744","https://openalex.org/W2125770033","https://openalex.org/W2139339270","https://openalex.org/W2155815418","https://openalex.org/W2157740020","https://openalex.org/W4255033750","https://openalex.org/W6633219197","https://openalex.org/W6634665569"],"related_works":["https://openalex.org/W2734832476","https://openalex.org/W2115775347","https://openalex.org/W2131757333","https://openalex.org/W1538306314","https://openalex.org/W1558706670","https://openalex.org/W2119461845","https://openalex.org/W2037047765","https://openalex.org/W3145382147","https://openalex.org/W2135762134","https://openalex.org/W102225768"],"abstract_inverted_index":{"Standard":[0],"pattern-matching":[1],"methods":[2],"used":[3],"for":[4,79],"deep":[5],"packet":[6],"inspection":[7],"and":[8,18,42,95,105,117],"network":[9],"security":[10],"can":[11,82],"be":[12,83],"evaded":[13],"by":[14],"means":[15],"of":[16,40,70,115,120,135],"TCP":[17],"IP":[19],"fragmentation.":[20],"To":[21],"detect":[22,60],"such":[23],"attacks,":[24],"intrusion":[25,136],"detection":[26,114,137],"systems":[27],"must":[28],"reassemble":[29],"packets":[30],"before":[31],"applying":[32],"matching":[33],"algorithms,":[34],"thus":[35,131],"requiring":[36],"a":[37,53,57],"large":[38],"amount":[39],"memory":[41],"time":[43],"to":[44,46,59,74,99],"respond":[45],"the":[47,50,102,113,121,127,133],"threat.":[48],"In":[49,110],"literature,":[51],"only":[52],"few":[54],"efforts":[55],"proposed":[56],"method":[58],"evasion":[61],"attacks":[62,116],"at":[63],"high":[64],"speed":[65],"without":[66],"reassembly.":[67],"The":[68],"aim":[69],"this":[71,111],"article":[72],"is":[73,89,124],"introduce":[75],"an":[76],"efficient":[77],"system":[78],"anti-evasion":[80],"that":[81],"implemented":[84],"in":[85,126],"real":[86],"devices.":[87],"It":[88],"based":[90],"on":[91],"counting":[92],"bloom":[93],"filters":[94],"exploits":[96],"their":[97],"capabilities":[98],"quickly":[100],"update":[101],"string":[103],"set":[104],"deal":[106],"with":[107],"partial":[108],"signatures.":[109],"way,":[112],"almost":[118],"all":[119],"traffic":[122],"processing":[123],"performed":[125],"fast":[128],"data":[129],"path,":[130],"improving":[132],"scalability":[134],"systems.":[138]},"counts_by_year":[{"year":2019,"cited_by_count":2},{"year":2017,"cited_by_count":1},{"year":2015,"cited_by_count":1},{"year":2014,"cited_by_count":3},{"year":2013,"cited_by_count":4}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}