LEADER 02875oam 2200433zu 450 001 9910130695603321 005 20241212220427.0 035 $a(CKB)3420000000000865 035 $a(SSID)ssj0000781203 035 $a(PQKBManifestationID)12366531 035 $a(PQKBTitleCode)TC0000781203 035 $a(PQKBWorkID)10804125 035 $a(PQKB)11448478 035 $a(NjHacI)993420000000000865 035 $a(EXLCZ)993420000000000865 100 $a20160829d2012 uy 101 0 $aeng 135 $aur||||||||||| 181 $ctxt 182 $cc 183 $acr 200 10$a2012 IEEE 20th International Symposium on Modelling, Analysis and Simulation of Computer and Telecommunication Systems 210 31$a[Place of publication not identified]$cIEEE$d2012 215 $a1 online resource $cillustrations 300 $aBibliographic Level Mode of Issuance: Monograph 311 08$a9780769547930 311 08$a0769547931 311 08$a9781467324533 311 08$a1467324531 330 $aNetwork traffic has traditionally exhibited temporal locality in the header field of packets. Such locality is intuitive and is a consequence of the semantics of network protocols. However, in contrast, the locality in the packet payload has not been studied in significant detail. In this work we study temporal locality in the packet payload. Temporal locality can also be viewed as redundancy, and we observe significant redundancy in the packet payload. We investigate mechanisms to exploit it in a networking application. We choose Intrusion Detection Systems (IDS) as a case study. An IDS like the popular Snort operates by scanning packet payload for known attack strings. It first builds a Finite State Machine (FSM) from a database of attack strings, and traverses this FSM using bytes from the packet payload. So temporal locality in network traffic provides us an opportunity to accelerate this FSM traversal. Our mechanism dynamically identifies redundant bytes in the packet and skips their redundant FSM traversal. We further parallelize our mechanism by performing the redundancy identification concurrently with stages of Snort packet processing. IDS are commonly deployed in commodity processors, and we evaluate our mechanism on an Intel Core i3. Our performance study indicates that the length of the redundant chunk is a key factor in performance. We also observe important performance benefits in deploying our redundancy-aware mechanism in the Snort IDS[32]. 606 $aDigital computer simulation$vCongresses 615 0$aDigital computer simulation 676 $a001.434 702 $aIEEE Staff 801 0$bPQKB 906 $aPROCEEDING 912 $a9910130695603321 996 $a2012 IEEE 20th International Symposium on Modelling, Analysis and Simulation of Computer and Telecommunication Systems$92348761 997 $aUNINA