Real-time regex matching with apache spark
No Thumbnail Available
Authors
Deaton, Sean
Brownfield, David
Kosta, Leonard
Zhu, Zhaozhong
Matthews, Suzanne J.
Issue Date
2017-09
Type
proceedings-article
Language
Keywords
Sparks , Real-time systems , Organizations , Partitioning algorithms , Anomaly detection , Monitoring , Big Data
Alternative Title
Abstract
Network Monitoring Systems (NMS) are an important part of protecting Army and enterprise networks. As governments and corporations grow, the amount of traffic data collected by NMS grows proportionally. To protect users against emerging threats, it is common practice for organizations to maintain a series of custom regular expression (regex) patterns to run on NMS data. However, the growth of network traffic makes it increasingly difficult for network administrators to perform this process quickly. In this paper, we describe a novel algorithm that leverages Apache Spark to perform regex matching in parallel. We test our approach on a dataset of 31 million Bro HTTP log events and 569 regular expressions provided by the Army Engineer Research & Development Center (ERDC). Our results indicate that we are able to process 1, 250 events in 1.047 seconds, meeting the desired definition of real-time.
Description
Citation
S. Deaton, D. Brownfield, L. Kosta, Z. Zhu and S. J. Matthews, "Real-time regex matching with apache spark," 2017 IEEE High Performance Extreme Computing Conference (HPEC), Waltham, MA, USA, 2017, pp. 1-6, doi: 10.1109/HPEC.2017.8091063.
Publisher
IEEE