{"id":"https://openalex.org/W2145492393","doi":"https://doi.org/10.1145/1132462.1132464","title":"Bit-split string-matching engines for intrusion detection and prevention","display_name":"Bit-split string-matching engines for intrusion detection and prevention","publication_year":2006,"publication_date":"2006-03-01","ids":{"openalex":"https://openalex.org/W2145492393","doi":"https://doi.org/10.1145/1132462.1132464","mag":"2145492393"},"language":"en","primary_location":{"id":"doi:10.1145/1132462.1132464","is_oa":true,"landing_page_url":"https://doi.org/10.1145/1132462.1132464","pdf_url":"http://dl.acm.org/ft_gateway.cfm?id=1132464&type=pdf","source":{"id":"https://openalex.org/S26056741","display_name":"ACM Transactions on Architecture and Code Optimization","issn_l":"1544-3566","issn":["1544-3566","1544-3973"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Architecture and Code Optimization","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"http://dl.acm.org/ft_gateway.cfm?id=1132464&type=pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5112726526","display_name":"Lin Tan","orcid":null},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Lin Tan","raw_affiliation_strings":["University of Illinois, Urbana-Champaign, Urbana, IL","University of Illinois - Urbana-Champaign, Urbana, IL"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois, Urbana-Champaign, Urbana, IL","institution_ids":["https://openalex.org/I157725225"]},{"raw_affiliation_string":"University of Illinois - Urbana-Champaign, Urbana, IL","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046306030","display_name":"Brett Brotherton","orcid":null},"institutions":[{"id":"https://openalex.org/I103635307","display_name":"University of California, Riverside","ror":"https://ror.org/03nawhv43","country_code":"US","type":"education","lineage":["https://openalex.org/I103635307"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Brett Brotherton","raw_affiliation_strings":["University of California, Riverside, CA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Riverside, CA","institution_ids":["https://openalex.org/I103635307"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5036932071","display_name":"Timothy Sherwood","orcid":"https://orcid.org/0000-0002-6550-6075"},"institutions":[{"id":"https://openalex.org/I154570441","display_name":"University of California, Santa Barbara","ror":"https://ror.org/02t274463","country_code":"US","type":"education","lineage":["https://openalex.org/I154570441"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Timothy Sherwood","raw_affiliation_strings":["University of California, Santa Barbara, CA","University of California, Santa Barbara, Ca#TAB#"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Santa Barbara, CA","institution_ids":["https://openalex.org/I154570441"]},{"raw_affiliation_string":"University of California, Santa Barbara, Ca#TAB#","institution_ids":["https://openalex.org/I154570441"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":5.3354,"has_fulltext":true,"cited_by_count":84,"citation_normalized_percentile":{"value":0.96157431,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":99},"biblio":{"volume":"3","issue":"1","first_page":"3","last_page":"34"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9976999759674072,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11478","display_name":"Caching and Content Delivery","score":0.9962000250816345,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8645874261856079},{"id":"https://openalex.org/keywords/string-searching-algorithm","display_name":"String searching algorithm","score":0.7650786638259888},{"id":"https://openalex.org/keywords/byte","display_name":"Byte","score":0.6219313740730286},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5957192778587341},{"id":"https://openalex.org/keywords/string","display_name":"String (physics)","score":0.5640217661857605},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.5530704259872437},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.5258291959762573},{"id":"https://openalex.org/keywords/matching","display_name":"Matching (statistics)","score":0.44474634528160095},{"id":"https://openalex.org/keywords/computer-engineering","display_name":"Computer engineering","score":0.4225497841835022},{"id":"https://openalex.org/keywords/deep-packet-inspection","display_name":"Deep packet inspection","score":0.41177183389663696},{"id":"https://openalex.org/keywords/pattern-matching","display_name":"Pattern matching","score":0.40770596265792847},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.3803340792655945},{"id":"https://openalex.org/keywords/algorithm","display_name":"Algorithm","score":0.36482951045036316},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.35023754835128784},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.2669503092765808},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.20821082592010498},{"id":"https://openalex.org/keywords/computer-hardware","display_name":"Computer hardware","score":0.1792236864566803},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.16103774309158325}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8645874261856079},{"id":"https://openalex.org/C7757238","wikidata":"https://www.wikidata.org/wiki/Q374040","display_name":"String searching algorithm","level":3,"score":0.7650786638259888},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.6219313740730286},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5957192778587341},{"id":"https://openalex.org/C157486923","wikidata":"https://www.wikidata.org/wiki/Q1376436","display_name":"String (physics)","level":2,"score":0.5640217661857605},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.5530704259872437},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.5258291959762573},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.44474634528160095},{"id":"https://openalex.org/C113775141","wikidata":"https://www.wikidata.org/wiki/Q428691","display_name":"Computer engineering","level":1,"score":0.4225497841835022},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.41177183389663696},{"id":"https://openalex.org/C68859911","wikidata":"https://www.wikidata.org/wiki/Q1503724","display_name":"Pattern matching","level":2,"score":0.40770596265792847},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3803340792655945},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.36482951045036316},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.35023754835128784},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.2669503092765808},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.20821082592010498},{"id":"https://openalex.org/C9390403","wikidata":"https://www.wikidata.org/wiki/Q3966","display_name":"Computer hardware","level":1,"score":0.1792236864566803},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.16103774309158325},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/1132462.1132464","is_oa":true,"landing_page_url":"https://doi.org/10.1145/1132462.1132464","pdf_url":"http://dl.acm.org/ft_gateway.cfm?id=1132464&type=pdf","source":{"id":"https://openalex.org/S26056741","display_name":"ACM Transactions on Architecture and Code Optimization","issn_l":"1544-3566","issn":["1544-3566","1544-3973"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Architecture and Code Optimization","raw_type":"journal-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.92.7103","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.92.7103","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.cs.ucsb.edu/~sherwood/pubs/TACO-bitsplit.pdf","raw_type":"text"}],"best_oa_location":{"id":"doi:10.1145/1132462.1132464","is_oa":true,"landing_page_url":"https://doi.org/10.1145/1132462.1132464","pdf_url":"http://dl.acm.org/ft_gateway.cfm?id=1132464&type=pdf","source":{"id":"https://openalex.org/S26056741","display_name":"ACM Transactions on Architecture and Code Optimization","issn_l":"1544-3566","issn":["1544-3566","1544-3973"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Architecture and Code Optimization","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1776976493","display_name":"CAREER:     Architectural Support for Online Security Analysis","funder_award_id":"0448654","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2145492393.pdf","grobid_xml":"https://content.openalex.org/works/W2145492393.grobid-xml"},"referenced_works_count":29,"referenced_works":["https://openalex.org/W1503562643","https://openalex.org/W1507645144","https://openalex.org/W1546149892","https://openalex.org/W1551186643","https://openalex.org/W1563402047","https://openalex.org/W1582606201","https://openalex.org/W1597305440","https://openalex.org/W1655192411","https://openalex.org/W1666083638","https://openalex.org/W1674877186","https://openalex.org/W1710586424","https://openalex.org/W1891233321","https://openalex.org/W1968801809","https://openalex.org/W2099964107","https://openalex.org/W2100087302","https://openalex.org/W2108712752","https://openalex.org/W2116967744","https://openalex.org/W2118599039","https://openalex.org/W2134684274","https://openalex.org/W2134826720","https://openalex.org/W2135932040","https://openalex.org/W2137145600","https://openalex.org/W2150007533","https://openalex.org/W2152484003","https://openalex.org/W2153102141","https://openalex.org/W2162080541","https://openalex.org/W2911708692","https://openalex.org/W4214544044","https://openalex.org/W6680117110"],"related_works":["https://openalex.org/W1497214516","https://openalex.org/W15130811","https://openalex.org/W3145288231","https://openalex.org/W2371263218","https://openalex.org/W4221052314","https://openalex.org/W2092552144","https://openalex.org/W2131757333","https://openalex.org/W2377397587","https://openalex.org/W2386564085","https://openalex.org/W2053280236"],"abstract_inverted_index":{"Network":[0],"Intrusion":[1],"Detection":[2],"and":[3,24,103,138,214,227],"Prevention":[4],"Systems":[5],"have":[6,160],"emerged":[7],"as":[8,96],"one":[9,42,83,119,139],"of":[10,15,28,43,75,84,87,89,106,197,205,211,217,220,229],"the":[11,22,26,44,52,61,64,69,101,187,194,212,218,224,254],"most":[12,45],"effective":[13],"ways":[14],"providing":[16],"security":[17],"to":[18,21,54,78,243],"those":[19],"connected":[20],"network":[23,97,152],"at":[25],"heart":[27],"almost":[29],"every":[30,73,76],"modern":[31],"intrusion":[32],"detection":[33],"system":[34,53,246],"is":[35,41,117,141,241,248],"a":[36,85,92,114,167,209,215,233,245],"string-matching":[37,235],"algorithm.":[38],"String":[39],"matching":[40,175],"critical":[46],"elements":[47],"because":[48],"it":[49,81,145,240],"allows":[50],"for":[51,179,208],"make":[55],"decisions":[56],"based":[57],"not":[58],"just":[59],"on":[60,125,166],"headers,":[62],"but":[63],"actual":[65],"content":[66],"flowing":[67],"through":[68],"network.":[70],"Unfortunately,":[71],"checking":[72],"byte":[74],"packet":[77],"see":[79],"if":[80],"matches":[82],"set":[86],"thousands":[88],"strings":[90,198],"becomes":[91],"computationally":[93],"intensive":[94],"task":[95],"speeds":[98],"grow":[99],"into":[100,156,199],"tens,":[102],"eventually":[104],"hundreds,":[105],"gigabits/second.":[107],"To":[108],"keep":[109],"up":[110],"with":[111,132,150,232],"these":[112],"speeds,":[113],"specialized":[115],"device":[116],"required,":[118],"that":[120,128,140,144,164,171,239,247],"can":[121,129,189],"maintain":[122],"tight":[123],"bounds":[124],"worst-case":[126],"performance,":[127],"be":[130,147,190],"updated":[131],"new":[133,234],"rules":[134,213],"without":[135],"interrupting":[136],"operation,":[137],"efficient":[142,252],"enough":[143],"could":[146],"included":[148],"on-chip":[149],"existing":[151],"chips":[153],"or":[154],"even":[155],"wireless":[157],"devices.":[158],"We":[159,184],"developed":[161],"an":[162],"approach":[163],"relies":[165],"special":[168],"purpose":[169],"architecture":[170,231],"executes":[172],"novel":[173],"string":[174],"algorithms":[176],"specially":[177],"optimized":[178],"implementation":[180],"in":[181],"our":[182,230],"design.":[183],"show":[185,238],"how":[186],"problem":[188],"solved":[191],"by":[192],"converting":[193],"large":[195],"database":[196],"many":[200],"tiny":[201],"state":[202],"machines,":[203],"each":[204,221],"which":[206],"searches":[207],"portion":[210,216],"bits":[219],"rule.":[222],"Through":[223],"careful":[225],"codesign":[226],"optimization":[228],"algorithm,":[236],"we":[237],"possible":[242],"build":[244],"10":[249],"times":[250],"more":[251],"than":[253],"currently":[255],"best":[256],"known":[257],"approaches.":[258]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2023,"cited_by_count":2},{"year":2021,"cited_by_count":3},{"year":2020,"cited_by_count":2},{"year":2018,"cited_by_count":3},{"year":2017,"cited_by_count":1},{"year":2016,"cited_by_count":6},{"year":2015,"cited_by_count":7},{"year":2014,"cited_by_count":3},{"year":2013,"cited_by_count":3},{"year":2012,"cited_by_count":7}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}