International Conference on Security and Management (SAM ’03) Similarity Searches in Computer Security

The reuse of algorithms and hardware developed for searches of large molecular biologic databases is examined for detecting new variants of computer attacks before they can inflict damage. New attacks are viewed as evolutions of previous attacks, with associated mutations, insertions, and deletions from either machine code or text script sequences. Similarity searches are done between previous attacks and internet packet contents in real time. Single integrated circuits capable of comparing five-hundred-byte query sequences to nearly two million bytes of internet traffic per second are discussed. 1