Sandeep Kumar and Eugene Spafford. An Application of Pattern Matching in Intrusion Detection . Technical Report 94-013, Purdue University, Department of Computer Sciences, March 1994. This classification is not strictly a hierarchy as characteristics simple to match at lower levels of the classification become intractable at upper levels. We examined various regular methods of representing and matching our attack signatures.
Regular expressions can represent only the simplest types of attacks.
By breaking the guard expressions into sequences of simpler instructions, common subexpression elimination can be performed to reduce the size of the sequence. Such elimination can be done across all the patterns. Our model has several important advantages. It is very portable, in the sense that intrusion signatures can be moved across sites without rewriting to accommodate fine differences in each vendor s implementation. Sandeep Kumar and Eugene Spafford.