Signature Detection in Sampled Packets

Deep packet inspection and payload analysis is required for various purposes such as the detection and identification of attacks as well as service and application-level analysis of packet streams. However, network-wide deployment of fullfledged network analyzers and intrusion detection systems is a very costly solution, especially in large networks and at high link speeds. On the other hand, modern routers, switches and monitoring probes are equipped with the capability to capture and export selected packet data to a remote collector. We developed and implemented a traffic analysis system which is able to apply online pattern matching to the received packet data, e.g. in order to detect known attack signatures. As bandwidth and computational resources are limited, it is necessary to restrict the amount of packet data that is captured and exported. Therefore, we analyzed rule sets of the popular Snort intrusion detection systems and determined which parts of a packet are relevant for signature detection and which parts can be removed without impairing the detection quality.