IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG
IEICE TRANSACTIONS ON INFORMATION AND SYSTEMS, v. E98D, NO 11, Page. 1994-1997
Considering diversified HTTP types, the performance bottleneck of signature-based classification must be resolved. We define a signature model classifying the traffic in multiple dimensions and suggest a hierarchical signature structure to remove signature redundancy and minimize search space. Our experiments on campus traffic demonstrated 1.8 times faster processing speed than the Aho-Corasick matching algorithm in Snort.