Research Article Based on Regular Expression...
Transcript of Research Article Based on Regular Expression...
Research ArticleBased on Regular Expression Matching of Evaluation ofthe Task Performance in WSN A Queue Theory Approach
Jie Wang Kai Cui Kuanjiu Zhou and Yanshuo Yu
School of Software Technology Dalian University of Technology Dalian 116620 China
Correspondence should be addressed to Kai Cui cuikai 006163com
Received 4 July 2014 Accepted 16 August 2014 Published 23 October 2014
Academic Editor Fei Yu
Copyright copy 2014 Jie Wang et alThis is an open access article distributed under the Creative Commons Attribution License whichpermits unrestricted use distribution and reproduction in any medium provided the original work is properly cited
Due to the limited resources of wireless sensor network low efficiency of real-time communication scheduling poor safety defectsand so forth a queuing performance evaluation approach based on regular expression match is proposed which is a methodthat consists of matching preprocessing phase validation phase and queuing model of performance evaluation phase Firstly thesubset of related sequence is generated in preprocessing phase guiding the validation phase distributed matching Secondly inthe validation phase the subset of features clustering the compressed matching table is more convenient for distributed parallelmatching Finally based on the queuing model the sensor networks of task scheduling dynamic performance are evaluatedExperiments show that our approach ensures accurate matching and computational efficiency of more than 70 it not onlyeffectively detects data packets and access control but also uses queuing method to determine the parameters of task scheduling inwireless sensor networks The method for medium scale or large scale distributed wireless node has a good applicability
1 Introduction
Most wireless sensor network (WSN) missions are to detectand environmental reporting events Since wireless sensornetworks usually work under severe environments their per-formance is often difficult or impossible to assess accuratelyTherefore how to evaluate the performance in the wirelesssensor network for task communication is the researchemphasis in recent years which becomes one of the mostattractive
Most current researches have focused on how to provideauthentication confidentiality integrity nonrepudiation andaccess control ad hoc [1 2] Distributed authentication isa very common approach to solve ad hoc security issues[3 4] However highly secure ad hoc approach in certaincircumstances the lack of a common approach [5 6]
Because regular expressions provide excellent communi-cation skills and flexibility they have been widely used ina variety of network security applications such as antivirusscanning network intrusion detection and prevention sys-tems [7] firewalls and traffic classification and monitoring[8] Deterministic finite automata (DFA) and nondetermin-istic finite automata (NFA) are the typical application of
regular expressions But this requires a certain store or time-consuming cycle tolerable for resource-constrained wirelesssensor condition is basically meeting the application require-ments Performance evaluation based on the communicationtask queuing model theory methods [9 10] in recent yearspublished several class methods
However previous methods suffer from the followingdisadvantages In typical queuing model customer arrivaland the service processing are independent However theyare relative to the sensor communication scheduling tasksSensors cannot receive communication and run the statemachine at the same time Usually the sensor is constantcommunication the occupied and communication task pro-cessing footprint The arrival of the communication task hasdifferent priorities The high-priority tasks can preempt thelow-priority tasks and the low-level tasks continue to runafter the high-priority tasks processing is complete Timeconstraints the traditional system analysis often consideredthe average time while the taskrsquos communication betweenwireless sensors needs to consider the maximum time afterwhich the time state machine will transmit to another state
The method of finite automata has researched in theregular expression matching system security for the wireless
Hindawi Publishing Corporatione Scientific World JournalVolume 2014 Article ID 654974 9 pageshttpdxdoiorg1011552014654974
2 The Scientific World Journal
sensor networks and matching performance is ignored tofurther discussion [11] similarly the evaluation of the per-formance based on the queue model in the wireless sensornetwork (WSN) has been discussed but the system securitymatching method not to do more research [12] therefore wecombined with the previous work in this paper the securitymatching method of finite automata and the performance ofthe queuing model was discussed in WSN
The rest of the paper is organized as follows Section 2reviews regular expression two-stage matching strategySection 3 explains the regular expressionmatching approachIn Section 4 model of task scheduling based on queuingtheory is proposed In Section 5 the priority queue with twoclasses of tasks is proposed We describe the performance ofthe wireless sensor communication tasks based on queuingtheory in Section 6 In Section 7 simulations are conductedfor illustrating the performance of our scheme Finally weconclude this paper in Section 8
2 Regular Expression Two-StageMatching Strategy [11]
Recent research has paid much attention to reduction ofthe huge memory usage for DFA-based regular expressionmatching as DFA is the preferred representation of regularexpression matching As a matter of fact they can onlyachieve memory reduction for specific regular expressionor signature sets of simple High-speed regular expressionmatching for real-world signature sets that contain thousandsof complex regular expressions can be hardly achieved Inmodern networking devices TCAMs (off-the-shelf chips)have been widely deployed However even if techniques suchas D2FA [13 14] are employed tables of DFA andNFA are toobig to be stored in TCAMs In 2012 the RegexFilter (a high-speed and memory efficient technique) was presented by Liuet al [15] Regular expression matching was been sped up byquickly searching these regular expressions that may matcheach arriving item as little as possible However this methodonly cares about the profiteering stage and left the verifyingstage without any optimization
21 Profiteering Stage For instance there is a regular expres-sion set called 119877 another set 119877
1015840 is constructed so thatany unmatched item of 119877
1015840 is also an unmatched item of119877 An item that does not match any regular expression inthe set [15] is unmatched item of a regular expression setGiven an item 119894 it will match against 1198771015840 to get set 119874(1198771015840 119894)firstly If 119874(1198771015840 119894) is empty it does not obviously match anymember in 119877 and therefore this item can be skipped safelyotherwise matching it against 119879 (119877119874(119877
1015840 119894)) will continue
where 119874(119877 119894) sube 119879 (119877 119874(1198771015840 119894)) sube 119877 Figure 1 shows the
relationship between match items and print (1198771015840) Becausemost items are unmatched and the match cost of 119877
0is much
less than that of 119877 the overall throughput of this approachcan be much higher than directly matching against 119877
22 Verifying Stage In the verifying stage how to buildcorrelation from profiteering print and reduce the memory
All items
Match items
R
Print R998400
Figure 1 Relationship between profiteering stage set and matchitems
cost of DFA tables is the main point that needs to be handledA DFA is presented by a 5-tuple (119876sum 120575 119902
0 119860) where 119876 is a
set of states 119875 is an alphabet sumtimes119876 rarr 119876 is the transitionfunction 119876
0is the start state and 119860 sube 119876 is a set of accepting
states The major part we should deal with is the DFA-basedalgorithms with the large amount of memory requirement tostore the transition table Software-based [16ndash18] and FPGA-based [19 20] regular expressionmatching algorithms are tra-ditional approaches with many shortcomings TCAM-basedsolutions have the advantages of easy encoding and highparallelism [13] Three novel techniques transition sharingtable consolidation and variable striding were proposed byLiu et al to reduceTCAMspace and improvematching speed
3 Regular Expression Matching Approach
The selecting process of regular expression ldquo119886[119887119888]119889 [119887119888]rdquowith five atoms is shown in Figure 2 The parameter 120573 = 256
is the boundary we define and the expression size of everyprint should be less than 120573 The selecting stage begins fromthe first atom The curr pointer keeps moving to the nextatom if ES(119903) value of the regular expression print between thebegin pointer and end pointer until the curr pointer arrivesat the fourth atom ldquosdotrdquo ES(119886[119887119888]119889 ) = 1 lowast 2 lowast 1 lowast 256 =
512 gt 120573 Condition ES(119903) lt 120573 does not hold and print119886[119887119888]119889 is selected Then a directed line from 119903
119894to 119875119894to mark
the correlation relationship is constructed Then in step 2it is included in the already selected print ldquo119886[119887119888]119889rdquo although[119887119888]119889 satisfies the condition According to section A 119886[119887119888]119889has higher matching probability (MP) than [119887119888]119889 thus [119887119888]119889is not selected The same criteria are processed in steps 3 4and 5 to select print
After selecting the print a relationship of this graph calledcorrelation sequence is generated as a directed graph from119903[1119899]
to 119901[1119898]
Every package will be transmitted across certain nodes
1198731 1198732 119873
119899according to ad hoc wireless protocol These
nodes will be grouped into two groups one group forprofiteering stage and the other group for verifying stageExtra package fields are adopted to make each node workcollaboratively and communicate with the other
The Scientific World Journal 3
1 2 2
Begin
Begin
Begin
Begin
Begin
Curr
Curr
Curr
Curr
Curr
a[bc]d is selected
2 2
[bc]d is not selected
[bc] is selected
a [bc] [bc]d
1
2
a[ab]d
[bc]
a [bc] [bc]d
a [bc] [bc]d
a [bc] [bc]d
a [bc] [bc]d
512
512
512256
512256
middot is not selected
middot
middot
middot
middot
middot
r1
ri
rn
ri = a[bc]d middot [bc]
d middot is selected
d middot
p1
p1
ps
pk
pm
Figure 2 Process of generating print 119901119894from 119903
119894
5
6
2
4
1
3
7
Package
Prefilteringand getp[1m]
Calculate
F(gi p[1m])
P1P2
Pn
Calculate
F(gi p[1m])
p1p2
pn
Calculate
F(gi p[1m])
p1p2
pn
gi
gi
gi
C1
C2
C3
C4
Figure 3 Matching process of ad hoc packages
The package matching process is demonstrated inFigure 3 Taking the limited computing power of each wire-less node into consideration the calculation of 119865(119892
119894 119901[1119898]
)
is simplified to be addition only At first the feature vector 119901119894
needs to be stored so that the sum of 119901119894can be calculated to
get119865(119892119894 119901[1119898]
)Theprofiteered correlation sequence119901[1sdotsdotsdot119898]
will be generated in node 2 after profiteering stage in node 1Then if 119901
[1sdotsdotsdot119898]is not empty the 119865(119892
119894 119901[1119898]
) is calculatedin node 2 by adding the feature vector 119901
119894 Verifying process
will continue in node 2 using the group 119892119894in its memory
when 119865(119892119894 119901[1119898]
) is larger than 120595 Otherwise the packagewill be transmitted to the next hop and 119892
119895will be matched
continually
4 Queue Model Description [12]
The pattern of communication between wireless sensorscan be divided into two modes the synchronous and theasynchronousmodes In synchronousmode when a pluralityof communication tasks are triggered the tasks schedulingwill be suspended At this moment the levels of querypriority and processes priority are executed in sequenceThismode has a higher efficiency when the transmissions are notfrequent However this will lead to an unacceptable high lossrate of the communication tasks when the transmissions arefrequently triggered In asynchronous mode when the taskto transmit the scheduling will not immediately to processhowever the priority communication tasks are added to thequeue in sequence then the wireless sensor through statemachine to fetch the head of the communication task in
4 The Scientific World Journal
IE IE IEINI0 INI1 INIn
d (x gt 2 y lt 3)
e (x gt
5 ygt 4)
y =
0
a (x lt 2) y = 0
f (x gt 2 y gt 4)
b (xgt2)
ex=
=0y
0
middot middot middot
c (x = 2) y = 0 S0
S1
S2
S3 S4 S5
Figure 4Queuing theorymodel of thewireless sensor networkwith119899 communication taskrsquos scheduling
the queue and executes the task scheduling function Thismodel greatly reduces the tasksrsquo loss thus determining thewireless sensor network (WSN) which is formed in one ofthe biggest communication task captains that are of greathelp to guide sensor network design Figure 4 shows 119899-taskcommunication scheduling based on the queuing theorymodel in the wireless sensor network
Input process communication tasks are divided into 119873
levels The first level has the highest priority the secondpriority has secondary priority and so forth The119873 level hasthe lowest priority Assume that each communication taskinterval is the Poisson distribution or negative exponentialdistribution The average time of the interval of the 119894th levelcommunication task is 120582
119894
Queuing rules the task responses as soon as the com-munication task arrival by the background task executioncall service when the task is not scheduling executed in thesystem The high-priority communication tasks priority isexecuted in sequence until the end of all high-priority tasksin the queue When the low-priority tasks are executing thehigh-priority task takes over the low-priority task and thelow-priority task will return to the queue the same prioritycommunication task followed by FCFS rues
Service process wireless sensor network uses the statemachine to drive communication task process assumingthat each time of the communication task is exponentialdistribution and the average service of level 119894 communicationtask rate is 120583
119894
The WSN communication tasks queue performanceparameters [21] (a) absolute throughput 119860 is the average
00 01 02 03
10
20
30
11
21
31
12
22
32
13
23
33
40 41 42 43
i
j
u21205822
1205822 1205822
1205822
1205822
12058221205822
1205822
1205822
u21205822
u21205822
12058311205821
1205831 12058311205821
12058311205821
12058311205821 12058311205821
12058311205821
1205821 1205821
1205821
1205821
1205831 1205821 1205821
middot middot middot
Figure 5 System state spaces and the transfer process
time of task service in the unit time (b) relative throughput119876 is the ratio of all the severed tasks and all request tasksin the unit time (c) the queue length of the average value119871119904is all communication tasks in the WSN (d) the queue
of average length 119871119902is the average number of the waiting
tasks in the queue (e) the average sojourn times 119882119904are the
average of the taskwaiting for service time119882119902and the average
service time 120591 (then 119882119904= 119882119902+ 120591) (f) busy period 119879
119887is the
random parameter (g) system loss rates 119875loss are the overflowprobability
5 Priority Queue with Two Classes of Tasks
Assume the queuing system is the preemptive priority The119894th task arrival is Poisson distribution with parameter 120582
119894
the service time is exponentially distributed with parameter120583(119894 = 1 2 ) Level 1th priority communication task ismore priority than level 2th priority task The system stateis 119864 = (119894 119895) 0 ⩽ 119894 0 ⩽ 119895 119894(119895) represents the 1(2) level ofthe communication tasksThe system state space distribution119875(119894 119895) = 119875
119894119895 0 ⩽ 119894 0 ⩽ 119895 The system transition process is
depicted in Figure 5
6 Tasks PerformanceIndicators in Sensor Network
The priority tasks processing is as follows when the 1stlevel task with parameters 120582
1and the 2nd level task with
parameters 1205822arrive service times of two level tasks are the
1205831and 120583
2 the taskrsquos priority is reduced in sequence and
they share the waiting queue The recursive calculation ofprobability matrix 119875
119894119895 0 ⩽ 119895 ⩽ 119873 needs a large amount
of calculation therefore Matlab software is the necessarysoftwareTheMM1 preemptive priority queuemodel is usedin the experiments The arrival of the 119894th level task process as
The Scientific World Journal 5
a Poisson distribution with the parameter 120582119894and service time
as a negative exponential distribution with the parameter120583119894(119894 = 1 2) The 1st level tasks are more priority than the
2nd level communication tasks Assume the parameters are1205821= 170 120582
2= 300 120583
1= 500 and 120583
2= 700
(1) Steady-State Queue Length Figure 6 shows the probabilityand the queue length as the 120583
2increasing The vertical axis
is the probability and the horizontal axis is the queue lengthIn the probability matrix 119875 = 0 the maximum queue lengthcan be obtained in the system and assures that taskrsquos buffer isenough to calculate the taskrsquos loss
In the simulation 119871119904= 40 which is the maximum queue
length when 119875 = 0 the arrivals of the taskrsquos probability are0 this means the possibility of task arrival does not exist andthe length does not grow Then when 119875 = 0 the length canbe regarded as the largest queue length(2) Average Sojourn Time Assume that every level of taskarrival is Poisson distribution The 119894th level tasks are withthe parameter 120582
119894 the service time is the negative exponential
distribution and the average service time is 1120583 The averagesojourn times 119882
1199041and 119882
1199042are calculated in the following
formulas
1199081199041=
1
120583 minus 1205821
1199081199021
= 1199081199041minus
1
120583=
1205821
120583 (120583 minus 1205821)
(1)
1199081199041= (1 +
1205821
1205822
) times (1
120583 minus 1205821minus 1205822
) minus1205821
1205822
times1
120583 minus 1205821
1199081199022
= 1199081199042minus
1
120583
(2)
(3) AverageWaiting Time [22]The sameway the queue of theaverage waiting times 119882
1199021and 119882
1199022is calculated as formula
(1)(4) Wireless Sensor Usage Rate [23] 119875 is the probability of thewireless sensor being idle then 120588 = 1 minus 119875 where 120588 is theoccupancy probability of communication task [24 25] Thegreater 120588 is the greater the occupancy probability is 120588 is theservice capacity or the load capacity To consider the prac-ticality of the model the queue length is not unlimited Todetermine the performance indicators we take the queuingmodel of MM1N and set the buffer capacity which is119898(5) Taskrsquos Throughput The communication taskrsquos time 119879 isdivide into three parts they are the taskrsquos processing time 119879
119894
the state machine processing time 119879119904 and the wireless sensor
idle time119879119903 119879119894+119879119904asymp 119879The taskrsquos processing is more priority
than the state machine processing Assume the tasks servicestrength is 120588
119894 then the tasks processing time is 119879
119894= 120588119894119879 and
the state machine processing time is 119879119904= (1 minus 120588
119894)119879
The processing of the finite automata is the queuingmodel ofMM1N the input processing with the parameter120582119904and the service time with the parameter 120583
119904are the
negative exponential distribution length of the buffer is 119899Theprocessing speed of the communication task is faster than
Queue length
Prob
abili
ty
0
005
01
015
02
5 10 15 20 25 30 35
1205821 = 190 1205822 = 230 1205831 = 450 1205832 = 500
1205821 = 220 1205822 = 230 1205831 = 450 1205832 = 500
1205821 = 170 1205822 = 300 1205831 = 500 1205832 = 500
1205821 = 100 1205822 = 230 1205831 = 450 1205832 = 500
Figure 6 Probability and queue length graph
the processing speed of the state machine Thus the actualprocessing capability of the state machine is 120583
119904119903= (1 minus 120588
119894)120583119904
and the buffer length is119898 then the loss rate is
119875lost =1 minus 120588119904119903
1 minus 120588119898+1119904119903
120588119898
119904119903 (3)
In particular 120588119904119903= 120582119904120583119904119903
As to formula (1) the calculation which the state machinethroughput computes is the following formula
1205820= 120582119904(1 minus
1 minus 120588119904119903
1 minus 120588119898+1119904119903
120588119898
119904119903) (4)
When the sensor network is severely overloading the120582119904≫ 120583119904119903 and the 120588
119904119903≫ 1 As to formula (2) formula (5) is
calculated due to formula (5) and the speed of the parameter120582119894affects the performance of the task processing the greater
120582119894is the lower the performance of the task processing is
When the communication tasks processing rate 120583119894and the
state machine processing rate 120583119903remain unchanged the
performance curve is a straight line in which the slope isminus120583119903120583119894 Consider
1205820asymp 120583119904119903= (1 minus 120588
119894) 120583119903= (1 minus
120582119894
120583119894
)120583119903 (5)
(6) Wireless Sensor Processing Capacity Assume the process-ing capacity is of119873mips the quantity of the tasks which needto be executed in the taskrsquos processing is 119862
1and the quantity
of the tasks which need to be executed in the state machineis1198622 then the taskrsquos processing capacity computes as formula
(3) formula (6) is as follows
120588119904119903=
120582119904
120583119904119903
=120582119894
(1 minus 120588119894) 120583119904
=120582119894
(1 minus (120582119894120583119894)) 120583119904
=120582119894
(1 minus (120582119894 (119873119862
1))) (119873119862
2)=
1205821198941198622
119873 minus 1205821198941198621
(6)
6 The Scientific World Journal
Table 1 Experimental parameters setting
Parameter L7-Filter SnortNum of RegExp 161 166Num of DFA states 1432 1257120573 (expression size) 256 256120595 (relevance frequency) [023 034] [023 034]120578 (match probability) [075 099] [075 099]120574 (similarity) [05 10] [05 10]
Take formula (6) into formula (3) the loss rate 119876 is
119876 = 119875lost =1 minus (120582
1198941198622 (119873 minus 120582
1198941198621))
1 minus [1205821198941198622 (119873 minus 120582
1198941198621)]119898+1
times(1205821198941198622)119898
[119873 minus 1205821198941198621]119898
=(1205821198941198622)119898
sum119898
119894=0[119873 minus 120582
1198941198621]119894
(1205821198941198622)119898minus119894
(7)
Formula (7) is the relationship between the loss rate andthe processing capacity It helps to determine the require-ments of the taskrsquos processing
7 Experiment
71 Experiment Set We evaluated our matching approachby regular expression sets extracted from two real-worldsystems named L7-Filter and Snort L7-Filter is famous opensource application layer traffic classier for LinuxThe payloadcontent of a flow and identified its application level protocolare reassembled through regular expression matching Snortis a well-known open-source intrusion detection systemwhich can be configured to performprotocol analysis probesand content inspecting over online traffic by detecting avariety of worms Two sets are chosen as 119877 = 119903
1 1199032 119903
119899
to perform the experiments The experiment parameters ESMP are set as shown in Table 1Then the local optimal valuecan be obtained during our experiments
Print size denotes the memory occupation of prints afterthe profiteering stage Group number is the group number ofcorrelative regular expression according to the parameter 120574Average similarity is the average value of similarity in eachgroup (see (2)) Package size is the testing packages lengthOur simulation environment is based on NS-2 (NetworkSimulator version 2) We set the number of nodes from 20 to100 Number of suspicious package is the number of packagethat needs to be verified after the profiteering stage Lastly wecalculate our experiment efficiency by their average executingcost Efficiency = (Num of suspicious packageTotal packageNumber) times (119865(119892
119894)Group Number)
Table 2 demonstrates that we can get a good efficiencypromotion from 7317 to 8973 A regular matchingcomparison was performed with our strategy and normalapproach The average hop and average 119865(119866
119894) variation
tendency and the number of nodes are shown in Figure 7L7-Filter and Snort were tested separately 119910-axis is hops and119909-axis indicates the nodes number From the results figure
Average hops on L7
010
50
40
30
20
10
20 30 40 50 60 70 80 90
Average hops on Snort
Nodes
10 20 30 40 50 60 70 80 90Nodes
Hops L7Hops L7 Gi
Hop
s
0
50
40
30
20
10
Hop
s
Hops SnortHops Snort Gi
Figure 7 Results of node average hops in NS-2
a significant difference can be observed when nodes aremorethan 30 the hops number of using 119866
119894decreases sharply
Figure 7 demonstrates that the matching approach cantest and verify the packages efficiently when the number ofwireless nodes is more than 30 which indicates that ourapproach can be well adapted to medium or large scaledistributed wireless sensor network On the other hand thereis no major difference in average hops when the system ishandling a small group of wireless nodes Comparing withother end-to-end strategies [9] our approach provides awell scalable way to construct intrusion detection systemby integrating distributed wireless sensor nodes Based onappropriate parameters network attacks can bemonitored byour system in an effective way
72 Experiment of Queue Model The experiment comparestwo groups of the performance results which computed bythe queuing theory and got the results from the softwareNS2 The NS2 platform simulated the STM32W108 sensornetworking we found that it is affected with the followingparameters the average length of stay for communicationtasks the average queue waiting time of tasks the occupancyrate and the task throughput
The Scientific World Journal 7
Table 2 Experimental data
Parameters
Results L7-Filter Snort1205781= 024
1205742= 077
1205951= 06
1205782= 026
1205742= 0831205952= 5
1205783= 036
1205743= 098
1205953= 10
1205781= 024
1205742= 077
1205951= 06
1205782= 026
1205742= 0831205952= 5
1205783= 036
1205743= 098
1205953= 10
Print size 015MB 031MB 012MB 025MB 039MB 024MBGroup number 14 17 11 14 15 12Average similarity 083 098 095 089 089 097Package size 1024 B 2048 B 4096 B 1024 B 2048 B 4096 BNumber of suspiciouspackage 253 83 122 41 114 48
Efficiency 8973 7317 765 831 7794 8535
Table 3 Experimental data statistics
Parameters
Indicator Queuing theory model calculation results NS2 simulation results1205821= 180 120582
2= 270
1205831= 1205832= 700
119898 = 100
1205821= 150 120582
2= 400
1205831= 1205832= 700
119898 = 35
1205821= 180
1205822= 400
119898 = 100
1205821= 150
1205822= 400
119898 = 35
Queue length 120 40 112 38
Average sojourn time(s) 1198821199041= 00019230
1198821199042= 0005385
1198821199041= 00018182
1198821199042= 0008485
1198821199041= 00018240
1198821199042= 0005062
1198821199041= 00016401
1198821199042= 000849
Average waiting time(s) 1198821199021
= 00004945
1198821199022
= 0004956
1198821199021
= 00003924
1198821199022
= 00069565
1198821199021
= 00003982
1198821199022
= 00045412
1198821199021
= 00002116
1198821199022
= 0006783
Wireless sensor usagerate 955 819 966 883
Sensor networkthroughput 436000 474300 453954 423561
Tasks loss rate 270677 0099 377 0098
Simulation software configuration communication taskstake the high-priority traffic and low-priority communica-tions task two categories Design the taskrsquos scheduling func-tion and assure 119862
1is approximately 400 operations and 119862
2is
about 4000 operationsThe program triggers communicationaccording to the different experimental parameters 120582 and119898 to test the influence on wireless sensor performanceThe experiment of the results compares with calculationresults of the method based on queuing theory to verifythe creditability of the method The statistics are shown inTable 3
When the sensor overloaded the sensor network handlesthe task for a long time and the state machine processing hasno support to the sensor network The actual speed of sensorprocessing 120583
119904119903is far less than 120583
119904 When the wireless sensor
network needed specific requirements 119905 of the loss rate andthe sensor throughput it can take the speed of the schedulingto the requirements
For formula (7) it can understand the relationshipbetween the loss rate and the capacity of scheduling It can
easily choose the right sensor in the network which willgreatly improve the quality of service
73 The Methods of Analysis The previous method of finiteautomata has discussed the regular expression matching sys-tem security in WSN and the evaluation of the performanceis ignored to research The matching method in some extentcan maintain the precision and accuracy in some systems itcan be used in a specific environment the performance of theevaluation in the wireless sensor network (WSN) that we hadresearched is in the universal environment it is necessary toconsider the problem of the restrictions such as the capacityof the buffer the length of the queue in the processing timethe performance of the calculation that needs enough bufferfor the task processing and the work conditions In ourresearch the approach which took the matching methodand the evaluating performance together is a new topic Themethod ensures maintaining the system security reducingthe loss rate of the communication task and improving theaccuracy of the scheduleThe universal approach can be used
8 The Scientific World Journal
in lots of environments in the wireless sensor network theapproach has a good excellent performance
8 Conclusions
This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth
The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model
Conflict of Interests
The authors declare that there is no conflict of interestsregarding the publication of this paper
Acknowledgments
This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)
References
[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014
[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002
[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002
[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003
[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011
[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of
the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999
[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011
[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008
[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005
[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011
[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014
[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013
[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012
[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006
[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012
[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008
[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006
[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006
[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007
[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001
[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000
[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational
The Scientific World Journal 9
approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009
[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011
[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009
[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010
Submit your manuscripts athttpwwwhindawicom
Computer Games Technology
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Distributed Sensor Networks
International Journal of
Advances in
FuzzySystems
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014
International Journal of
ReconfigurableComputing
Hindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Applied Computational Intelligence and Soft Computing
thinspAdvancesthinspinthinsp
Artificial Intelligence
HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014
Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Electrical and Computer Engineering
Journal of
Journal of
Computer Networks and Communications
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporation
httpwwwhindawicom Volume 2014
Advances in
Multimedia
International Journal of
Biomedical Imaging
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
ArtificialNeural Systems
Advances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
RoboticsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Computational Intelligence and Neuroscience
Industrial EngineeringJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Human-ComputerInteraction
Advances in
Computer EngineeringAdvances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
2 The Scientific World Journal
sensor networks and matching performance is ignored tofurther discussion [11] similarly the evaluation of the per-formance based on the queue model in the wireless sensornetwork (WSN) has been discussed but the system securitymatching method not to do more research [12] therefore wecombined with the previous work in this paper the securitymatching method of finite automata and the performance ofthe queuing model was discussed in WSN
The rest of the paper is organized as follows Section 2reviews regular expression two-stage matching strategySection 3 explains the regular expressionmatching approachIn Section 4 model of task scheduling based on queuingtheory is proposed In Section 5 the priority queue with twoclasses of tasks is proposed We describe the performance ofthe wireless sensor communication tasks based on queuingtheory in Section 6 In Section 7 simulations are conductedfor illustrating the performance of our scheme Finally weconclude this paper in Section 8
2 Regular Expression Two-StageMatching Strategy [11]
Recent research has paid much attention to reduction ofthe huge memory usage for DFA-based regular expressionmatching as DFA is the preferred representation of regularexpression matching As a matter of fact they can onlyachieve memory reduction for specific regular expressionor signature sets of simple High-speed regular expressionmatching for real-world signature sets that contain thousandsof complex regular expressions can be hardly achieved Inmodern networking devices TCAMs (off-the-shelf chips)have been widely deployed However even if techniques suchas D2FA [13 14] are employed tables of DFA andNFA are toobig to be stored in TCAMs In 2012 the RegexFilter (a high-speed and memory efficient technique) was presented by Liuet al [15] Regular expression matching was been sped up byquickly searching these regular expressions that may matcheach arriving item as little as possible However this methodonly cares about the profiteering stage and left the verifyingstage without any optimization
21 Profiteering Stage For instance there is a regular expres-sion set called 119877 another set 119877
1015840 is constructed so thatany unmatched item of 119877
1015840 is also an unmatched item of119877 An item that does not match any regular expression inthe set [15] is unmatched item of a regular expression setGiven an item 119894 it will match against 1198771015840 to get set 119874(1198771015840 119894)firstly If 119874(1198771015840 119894) is empty it does not obviously match anymember in 119877 and therefore this item can be skipped safelyotherwise matching it against 119879 (119877119874(119877
1015840 119894)) will continue
where 119874(119877 119894) sube 119879 (119877 119874(1198771015840 119894)) sube 119877 Figure 1 shows the
relationship between match items and print (1198771015840) Becausemost items are unmatched and the match cost of 119877
0is much
less than that of 119877 the overall throughput of this approachcan be much higher than directly matching against 119877
22 Verifying Stage In the verifying stage how to buildcorrelation from profiteering print and reduce the memory
All items
Match items
R
Print R998400
Figure 1 Relationship between profiteering stage set and matchitems
cost of DFA tables is the main point that needs to be handledA DFA is presented by a 5-tuple (119876sum 120575 119902
0 119860) where 119876 is a
set of states 119875 is an alphabet sumtimes119876 rarr 119876 is the transitionfunction 119876
0is the start state and 119860 sube 119876 is a set of accepting
states The major part we should deal with is the DFA-basedalgorithms with the large amount of memory requirement tostore the transition table Software-based [16ndash18] and FPGA-based [19 20] regular expressionmatching algorithms are tra-ditional approaches with many shortcomings TCAM-basedsolutions have the advantages of easy encoding and highparallelism [13] Three novel techniques transition sharingtable consolidation and variable striding were proposed byLiu et al to reduceTCAMspace and improvematching speed
3 Regular Expression Matching Approach
The selecting process of regular expression ldquo119886[119887119888]119889 [119887119888]rdquowith five atoms is shown in Figure 2 The parameter 120573 = 256
is the boundary we define and the expression size of everyprint should be less than 120573 The selecting stage begins fromthe first atom The curr pointer keeps moving to the nextatom if ES(119903) value of the regular expression print between thebegin pointer and end pointer until the curr pointer arrivesat the fourth atom ldquosdotrdquo ES(119886[119887119888]119889 ) = 1 lowast 2 lowast 1 lowast 256 =
512 gt 120573 Condition ES(119903) lt 120573 does not hold and print119886[119887119888]119889 is selected Then a directed line from 119903
119894to 119875119894to mark
the correlation relationship is constructed Then in step 2it is included in the already selected print ldquo119886[119887119888]119889rdquo although[119887119888]119889 satisfies the condition According to section A 119886[119887119888]119889has higher matching probability (MP) than [119887119888]119889 thus [119887119888]119889is not selected The same criteria are processed in steps 3 4and 5 to select print
After selecting the print a relationship of this graph calledcorrelation sequence is generated as a directed graph from119903[1119899]
to 119901[1119898]
Every package will be transmitted across certain nodes
1198731 1198732 119873
119899according to ad hoc wireless protocol These
nodes will be grouped into two groups one group forprofiteering stage and the other group for verifying stageExtra package fields are adopted to make each node workcollaboratively and communicate with the other
The Scientific World Journal 3
1 2 2
Begin
Begin
Begin
Begin
Begin
Curr
Curr
Curr
Curr
Curr
a[bc]d is selected
2 2
[bc]d is not selected
[bc] is selected
a [bc] [bc]d
1
2
a[ab]d
[bc]
a [bc] [bc]d
a [bc] [bc]d
a [bc] [bc]d
a [bc] [bc]d
512
512
512256
512256
middot is not selected
middot
middot
middot
middot
middot
r1
ri
rn
ri = a[bc]d middot [bc]
d middot is selected
d middot
p1
p1
ps
pk
pm
Figure 2 Process of generating print 119901119894from 119903
119894
5
6
2
4
1
3
7
Package
Prefilteringand getp[1m]
Calculate
F(gi p[1m])
P1P2
Pn
Calculate
F(gi p[1m])
p1p2
pn
Calculate
F(gi p[1m])
p1p2
pn
gi
gi
gi
C1
C2
C3
C4
Figure 3 Matching process of ad hoc packages
The package matching process is demonstrated inFigure 3 Taking the limited computing power of each wire-less node into consideration the calculation of 119865(119892
119894 119901[1119898]
)
is simplified to be addition only At first the feature vector 119901119894
needs to be stored so that the sum of 119901119894can be calculated to
get119865(119892119894 119901[1119898]
)Theprofiteered correlation sequence119901[1sdotsdotsdot119898]
will be generated in node 2 after profiteering stage in node 1Then if 119901
[1sdotsdotsdot119898]is not empty the 119865(119892
119894 119901[1119898]
) is calculatedin node 2 by adding the feature vector 119901
119894 Verifying process
will continue in node 2 using the group 119892119894in its memory
when 119865(119892119894 119901[1119898]
) is larger than 120595 Otherwise the packagewill be transmitted to the next hop and 119892
119895will be matched
continually
4 Queue Model Description [12]
The pattern of communication between wireless sensorscan be divided into two modes the synchronous and theasynchronousmodes In synchronousmode when a pluralityof communication tasks are triggered the tasks schedulingwill be suspended At this moment the levels of querypriority and processes priority are executed in sequenceThismode has a higher efficiency when the transmissions are notfrequent However this will lead to an unacceptable high lossrate of the communication tasks when the transmissions arefrequently triggered In asynchronous mode when the taskto transmit the scheduling will not immediately to processhowever the priority communication tasks are added to thequeue in sequence then the wireless sensor through statemachine to fetch the head of the communication task in
4 The Scientific World Journal
IE IE IEINI0 INI1 INIn
d (x gt 2 y lt 3)
e (x gt
5 ygt 4)
y =
0
a (x lt 2) y = 0
f (x gt 2 y gt 4)
b (xgt2)
ex=
=0y
0
middot middot middot
c (x = 2) y = 0 S0
S1
S2
S3 S4 S5
Figure 4Queuing theorymodel of thewireless sensor networkwith119899 communication taskrsquos scheduling
the queue and executes the task scheduling function Thismodel greatly reduces the tasksrsquo loss thus determining thewireless sensor network (WSN) which is formed in one ofthe biggest communication task captains that are of greathelp to guide sensor network design Figure 4 shows 119899-taskcommunication scheduling based on the queuing theorymodel in the wireless sensor network
Input process communication tasks are divided into 119873
levels The first level has the highest priority the secondpriority has secondary priority and so forth The119873 level hasthe lowest priority Assume that each communication taskinterval is the Poisson distribution or negative exponentialdistribution The average time of the interval of the 119894th levelcommunication task is 120582
119894
Queuing rules the task responses as soon as the com-munication task arrival by the background task executioncall service when the task is not scheduling executed in thesystem The high-priority communication tasks priority isexecuted in sequence until the end of all high-priority tasksin the queue When the low-priority tasks are executing thehigh-priority task takes over the low-priority task and thelow-priority task will return to the queue the same prioritycommunication task followed by FCFS rues
Service process wireless sensor network uses the statemachine to drive communication task process assumingthat each time of the communication task is exponentialdistribution and the average service of level 119894 communicationtask rate is 120583
119894
The WSN communication tasks queue performanceparameters [21] (a) absolute throughput 119860 is the average
00 01 02 03
10
20
30
11
21
31
12
22
32
13
23
33
40 41 42 43
i
j
u21205822
1205822 1205822
1205822
1205822
12058221205822
1205822
1205822
u21205822
u21205822
12058311205821
1205831 12058311205821
12058311205821
12058311205821 12058311205821
12058311205821
1205821 1205821
1205821
1205821
1205831 1205821 1205821
middot middot middot
Figure 5 System state spaces and the transfer process
time of task service in the unit time (b) relative throughput119876 is the ratio of all the severed tasks and all request tasksin the unit time (c) the queue length of the average value119871119904is all communication tasks in the WSN (d) the queue
of average length 119871119902is the average number of the waiting
tasks in the queue (e) the average sojourn times 119882119904are the
average of the taskwaiting for service time119882119902and the average
service time 120591 (then 119882119904= 119882119902+ 120591) (f) busy period 119879
119887is the
random parameter (g) system loss rates 119875loss are the overflowprobability
5 Priority Queue with Two Classes of Tasks
Assume the queuing system is the preemptive priority The119894th task arrival is Poisson distribution with parameter 120582
119894
the service time is exponentially distributed with parameter120583(119894 = 1 2 ) Level 1th priority communication task ismore priority than level 2th priority task The system stateis 119864 = (119894 119895) 0 ⩽ 119894 0 ⩽ 119895 119894(119895) represents the 1(2) level ofthe communication tasksThe system state space distribution119875(119894 119895) = 119875
119894119895 0 ⩽ 119894 0 ⩽ 119895 The system transition process is
depicted in Figure 5
6 Tasks PerformanceIndicators in Sensor Network
The priority tasks processing is as follows when the 1stlevel task with parameters 120582
1and the 2nd level task with
parameters 1205822arrive service times of two level tasks are the
1205831and 120583
2 the taskrsquos priority is reduced in sequence and
they share the waiting queue The recursive calculation ofprobability matrix 119875
119894119895 0 ⩽ 119895 ⩽ 119873 needs a large amount
of calculation therefore Matlab software is the necessarysoftwareTheMM1 preemptive priority queuemodel is usedin the experiments The arrival of the 119894th level task process as
The Scientific World Journal 5
a Poisson distribution with the parameter 120582119894and service time
as a negative exponential distribution with the parameter120583119894(119894 = 1 2) The 1st level tasks are more priority than the
2nd level communication tasks Assume the parameters are1205821= 170 120582
2= 300 120583
1= 500 and 120583
2= 700
(1) Steady-State Queue Length Figure 6 shows the probabilityand the queue length as the 120583
2increasing The vertical axis
is the probability and the horizontal axis is the queue lengthIn the probability matrix 119875 = 0 the maximum queue lengthcan be obtained in the system and assures that taskrsquos buffer isenough to calculate the taskrsquos loss
In the simulation 119871119904= 40 which is the maximum queue
length when 119875 = 0 the arrivals of the taskrsquos probability are0 this means the possibility of task arrival does not exist andthe length does not grow Then when 119875 = 0 the length canbe regarded as the largest queue length(2) Average Sojourn Time Assume that every level of taskarrival is Poisson distribution The 119894th level tasks are withthe parameter 120582
119894 the service time is the negative exponential
distribution and the average service time is 1120583 The averagesojourn times 119882
1199041and 119882
1199042are calculated in the following
formulas
1199081199041=
1
120583 minus 1205821
1199081199021
= 1199081199041minus
1
120583=
1205821
120583 (120583 minus 1205821)
(1)
1199081199041= (1 +
1205821
1205822
) times (1
120583 minus 1205821minus 1205822
) minus1205821
1205822
times1
120583 minus 1205821
1199081199022
= 1199081199042minus
1
120583
(2)
(3) AverageWaiting Time [22]The sameway the queue of theaverage waiting times 119882
1199021and 119882
1199022is calculated as formula
(1)(4) Wireless Sensor Usage Rate [23] 119875 is the probability of thewireless sensor being idle then 120588 = 1 minus 119875 where 120588 is theoccupancy probability of communication task [24 25] Thegreater 120588 is the greater the occupancy probability is 120588 is theservice capacity or the load capacity To consider the prac-ticality of the model the queue length is not unlimited Todetermine the performance indicators we take the queuingmodel of MM1N and set the buffer capacity which is119898(5) Taskrsquos Throughput The communication taskrsquos time 119879 isdivide into three parts they are the taskrsquos processing time 119879
119894
the state machine processing time 119879119904 and the wireless sensor
idle time119879119903 119879119894+119879119904asymp 119879The taskrsquos processing is more priority
than the state machine processing Assume the tasks servicestrength is 120588
119894 then the tasks processing time is 119879
119894= 120588119894119879 and
the state machine processing time is 119879119904= (1 minus 120588
119894)119879
The processing of the finite automata is the queuingmodel ofMM1N the input processing with the parameter120582119904and the service time with the parameter 120583
119904are the
negative exponential distribution length of the buffer is 119899Theprocessing speed of the communication task is faster than
Queue length
Prob
abili
ty
0
005
01
015
02
5 10 15 20 25 30 35
1205821 = 190 1205822 = 230 1205831 = 450 1205832 = 500
1205821 = 220 1205822 = 230 1205831 = 450 1205832 = 500
1205821 = 170 1205822 = 300 1205831 = 500 1205832 = 500
1205821 = 100 1205822 = 230 1205831 = 450 1205832 = 500
Figure 6 Probability and queue length graph
the processing speed of the state machine Thus the actualprocessing capability of the state machine is 120583
119904119903= (1 minus 120588
119894)120583119904
and the buffer length is119898 then the loss rate is
119875lost =1 minus 120588119904119903
1 minus 120588119898+1119904119903
120588119898
119904119903 (3)
In particular 120588119904119903= 120582119904120583119904119903
As to formula (1) the calculation which the state machinethroughput computes is the following formula
1205820= 120582119904(1 minus
1 minus 120588119904119903
1 minus 120588119898+1119904119903
120588119898
119904119903) (4)
When the sensor network is severely overloading the120582119904≫ 120583119904119903 and the 120588
119904119903≫ 1 As to formula (2) formula (5) is
calculated due to formula (5) and the speed of the parameter120582119894affects the performance of the task processing the greater
120582119894is the lower the performance of the task processing is
When the communication tasks processing rate 120583119894and the
state machine processing rate 120583119903remain unchanged the
performance curve is a straight line in which the slope isminus120583119903120583119894 Consider
1205820asymp 120583119904119903= (1 minus 120588
119894) 120583119903= (1 minus
120582119894
120583119894
)120583119903 (5)
(6) Wireless Sensor Processing Capacity Assume the process-ing capacity is of119873mips the quantity of the tasks which needto be executed in the taskrsquos processing is 119862
1and the quantity
of the tasks which need to be executed in the state machineis1198622 then the taskrsquos processing capacity computes as formula
(3) formula (6) is as follows
120588119904119903=
120582119904
120583119904119903
=120582119894
(1 minus 120588119894) 120583119904
=120582119894
(1 minus (120582119894120583119894)) 120583119904
=120582119894
(1 minus (120582119894 (119873119862
1))) (119873119862
2)=
1205821198941198622
119873 minus 1205821198941198621
(6)
6 The Scientific World Journal
Table 1 Experimental parameters setting
Parameter L7-Filter SnortNum of RegExp 161 166Num of DFA states 1432 1257120573 (expression size) 256 256120595 (relevance frequency) [023 034] [023 034]120578 (match probability) [075 099] [075 099]120574 (similarity) [05 10] [05 10]
Take formula (6) into formula (3) the loss rate 119876 is
119876 = 119875lost =1 minus (120582
1198941198622 (119873 minus 120582
1198941198621))
1 minus [1205821198941198622 (119873 minus 120582
1198941198621)]119898+1
times(1205821198941198622)119898
[119873 minus 1205821198941198621]119898
=(1205821198941198622)119898
sum119898
119894=0[119873 minus 120582
1198941198621]119894
(1205821198941198622)119898minus119894
(7)
Formula (7) is the relationship between the loss rate andthe processing capacity It helps to determine the require-ments of the taskrsquos processing
7 Experiment
71 Experiment Set We evaluated our matching approachby regular expression sets extracted from two real-worldsystems named L7-Filter and Snort L7-Filter is famous opensource application layer traffic classier for LinuxThe payloadcontent of a flow and identified its application level protocolare reassembled through regular expression matching Snortis a well-known open-source intrusion detection systemwhich can be configured to performprotocol analysis probesand content inspecting over online traffic by detecting avariety of worms Two sets are chosen as 119877 = 119903
1 1199032 119903
119899
to perform the experiments The experiment parameters ESMP are set as shown in Table 1Then the local optimal valuecan be obtained during our experiments
Print size denotes the memory occupation of prints afterthe profiteering stage Group number is the group number ofcorrelative regular expression according to the parameter 120574Average similarity is the average value of similarity in eachgroup (see (2)) Package size is the testing packages lengthOur simulation environment is based on NS-2 (NetworkSimulator version 2) We set the number of nodes from 20 to100 Number of suspicious package is the number of packagethat needs to be verified after the profiteering stage Lastly wecalculate our experiment efficiency by their average executingcost Efficiency = (Num of suspicious packageTotal packageNumber) times (119865(119892
119894)Group Number)
Table 2 demonstrates that we can get a good efficiencypromotion from 7317 to 8973 A regular matchingcomparison was performed with our strategy and normalapproach The average hop and average 119865(119866
119894) variation
tendency and the number of nodes are shown in Figure 7L7-Filter and Snort were tested separately 119910-axis is hops and119909-axis indicates the nodes number From the results figure
Average hops on L7
010
50
40
30
20
10
20 30 40 50 60 70 80 90
Average hops on Snort
Nodes
10 20 30 40 50 60 70 80 90Nodes
Hops L7Hops L7 Gi
Hop
s
0
50
40
30
20
10
Hop
s
Hops SnortHops Snort Gi
Figure 7 Results of node average hops in NS-2
a significant difference can be observed when nodes aremorethan 30 the hops number of using 119866
119894decreases sharply
Figure 7 demonstrates that the matching approach cantest and verify the packages efficiently when the number ofwireless nodes is more than 30 which indicates that ourapproach can be well adapted to medium or large scaledistributed wireless sensor network On the other hand thereis no major difference in average hops when the system ishandling a small group of wireless nodes Comparing withother end-to-end strategies [9] our approach provides awell scalable way to construct intrusion detection systemby integrating distributed wireless sensor nodes Based onappropriate parameters network attacks can bemonitored byour system in an effective way
72 Experiment of Queue Model The experiment comparestwo groups of the performance results which computed bythe queuing theory and got the results from the softwareNS2 The NS2 platform simulated the STM32W108 sensornetworking we found that it is affected with the followingparameters the average length of stay for communicationtasks the average queue waiting time of tasks the occupancyrate and the task throughput
The Scientific World Journal 7
Table 2 Experimental data
Parameters
Results L7-Filter Snort1205781= 024
1205742= 077
1205951= 06
1205782= 026
1205742= 0831205952= 5
1205783= 036
1205743= 098
1205953= 10
1205781= 024
1205742= 077
1205951= 06
1205782= 026
1205742= 0831205952= 5
1205783= 036
1205743= 098
1205953= 10
Print size 015MB 031MB 012MB 025MB 039MB 024MBGroup number 14 17 11 14 15 12Average similarity 083 098 095 089 089 097Package size 1024 B 2048 B 4096 B 1024 B 2048 B 4096 BNumber of suspiciouspackage 253 83 122 41 114 48
Efficiency 8973 7317 765 831 7794 8535
Table 3 Experimental data statistics
Parameters
Indicator Queuing theory model calculation results NS2 simulation results1205821= 180 120582
2= 270
1205831= 1205832= 700
119898 = 100
1205821= 150 120582
2= 400
1205831= 1205832= 700
119898 = 35
1205821= 180
1205822= 400
119898 = 100
1205821= 150
1205822= 400
119898 = 35
Queue length 120 40 112 38
Average sojourn time(s) 1198821199041= 00019230
1198821199042= 0005385
1198821199041= 00018182
1198821199042= 0008485
1198821199041= 00018240
1198821199042= 0005062
1198821199041= 00016401
1198821199042= 000849
Average waiting time(s) 1198821199021
= 00004945
1198821199022
= 0004956
1198821199021
= 00003924
1198821199022
= 00069565
1198821199021
= 00003982
1198821199022
= 00045412
1198821199021
= 00002116
1198821199022
= 0006783
Wireless sensor usagerate 955 819 966 883
Sensor networkthroughput 436000 474300 453954 423561
Tasks loss rate 270677 0099 377 0098
Simulation software configuration communication taskstake the high-priority traffic and low-priority communica-tions task two categories Design the taskrsquos scheduling func-tion and assure 119862
1is approximately 400 operations and 119862
2is
about 4000 operationsThe program triggers communicationaccording to the different experimental parameters 120582 and119898 to test the influence on wireless sensor performanceThe experiment of the results compares with calculationresults of the method based on queuing theory to verifythe creditability of the method The statistics are shown inTable 3
When the sensor overloaded the sensor network handlesthe task for a long time and the state machine processing hasno support to the sensor network The actual speed of sensorprocessing 120583
119904119903is far less than 120583
119904 When the wireless sensor
network needed specific requirements 119905 of the loss rate andthe sensor throughput it can take the speed of the schedulingto the requirements
For formula (7) it can understand the relationshipbetween the loss rate and the capacity of scheduling It can
easily choose the right sensor in the network which willgreatly improve the quality of service
73 The Methods of Analysis The previous method of finiteautomata has discussed the regular expression matching sys-tem security in WSN and the evaluation of the performanceis ignored to research The matching method in some extentcan maintain the precision and accuracy in some systems itcan be used in a specific environment the performance of theevaluation in the wireless sensor network (WSN) that we hadresearched is in the universal environment it is necessary toconsider the problem of the restrictions such as the capacityof the buffer the length of the queue in the processing timethe performance of the calculation that needs enough bufferfor the task processing and the work conditions In ourresearch the approach which took the matching methodand the evaluating performance together is a new topic Themethod ensures maintaining the system security reducingthe loss rate of the communication task and improving theaccuracy of the scheduleThe universal approach can be used
8 The Scientific World Journal
in lots of environments in the wireless sensor network theapproach has a good excellent performance
8 Conclusions
This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth
The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model
Conflict of Interests
The authors declare that there is no conflict of interestsregarding the publication of this paper
Acknowledgments
This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)
References
[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014
[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002
[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002
[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003
[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011
[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of
the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999
[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011
[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008
[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005
[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011
[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014
[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013
[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012
[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006
[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012
[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008
[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006
[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006
[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007
[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001
[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000
[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational
The Scientific World Journal 9
approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009
[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011
[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009
[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010
Submit your manuscripts athttpwwwhindawicom
Computer Games Technology
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Distributed Sensor Networks
International Journal of
Advances in
FuzzySystems
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014
International Journal of
ReconfigurableComputing
Hindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Applied Computational Intelligence and Soft Computing
thinspAdvancesthinspinthinsp
Artificial Intelligence
HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014
Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Electrical and Computer Engineering
Journal of
Journal of
Computer Networks and Communications
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporation
httpwwwhindawicom Volume 2014
Advances in
Multimedia
International Journal of
Biomedical Imaging
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
ArtificialNeural Systems
Advances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
RoboticsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Computational Intelligence and Neuroscience
Industrial EngineeringJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Human-ComputerInteraction
Advances in
Computer EngineeringAdvances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World Journal 3
1 2 2
Begin
Begin
Begin
Begin
Begin
Curr
Curr
Curr
Curr
Curr
a[bc]d is selected
2 2
[bc]d is not selected
[bc] is selected
a [bc] [bc]d
1
2
a[ab]d
[bc]
a [bc] [bc]d
a [bc] [bc]d
a [bc] [bc]d
a [bc] [bc]d
512
512
512256
512256
middot is not selected
middot
middot
middot
middot
middot
r1
ri
rn
ri = a[bc]d middot [bc]
d middot is selected
d middot
p1
p1
ps
pk
pm
Figure 2 Process of generating print 119901119894from 119903
119894
5
6
2
4
1
3
7
Package
Prefilteringand getp[1m]
Calculate
F(gi p[1m])
P1P2
Pn
Calculate
F(gi p[1m])
p1p2
pn
Calculate
F(gi p[1m])
p1p2
pn
gi
gi
gi
C1
C2
C3
C4
Figure 3 Matching process of ad hoc packages
The package matching process is demonstrated inFigure 3 Taking the limited computing power of each wire-less node into consideration the calculation of 119865(119892
119894 119901[1119898]
)
is simplified to be addition only At first the feature vector 119901119894
needs to be stored so that the sum of 119901119894can be calculated to
get119865(119892119894 119901[1119898]
)Theprofiteered correlation sequence119901[1sdotsdotsdot119898]
will be generated in node 2 after profiteering stage in node 1Then if 119901
[1sdotsdotsdot119898]is not empty the 119865(119892
119894 119901[1119898]
) is calculatedin node 2 by adding the feature vector 119901
119894 Verifying process
will continue in node 2 using the group 119892119894in its memory
when 119865(119892119894 119901[1119898]
) is larger than 120595 Otherwise the packagewill be transmitted to the next hop and 119892
119895will be matched
continually
4 Queue Model Description [12]
The pattern of communication between wireless sensorscan be divided into two modes the synchronous and theasynchronousmodes In synchronousmode when a pluralityof communication tasks are triggered the tasks schedulingwill be suspended At this moment the levels of querypriority and processes priority are executed in sequenceThismode has a higher efficiency when the transmissions are notfrequent However this will lead to an unacceptable high lossrate of the communication tasks when the transmissions arefrequently triggered In asynchronous mode when the taskto transmit the scheduling will not immediately to processhowever the priority communication tasks are added to thequeue in sequence then the wireless sensor through statemachine to fetch the head of the communication task in
4 The Scientific World Journal
IE IE IEINI0 INI1 INIn
d (x gt 2 y lt 3)
e (x gt
5 ygt 4)
y =
0
a (x lt 2) y = 0
f (x gt 2 y gt 4)
b (xgt2)
ex=
=0y
0
middot middot middot
c (x = 2) y = 0 S0
S1
S2
S3 S4 S5
Figure 4Queuing theorymodel of thewireless sensor networkwith119899 communication taskrsquos scheduling
the queue and executes the task scheduling function Thismodel greatly reduces the tasksrsquo loss thus determining thewireless sensor network (WSN) which is formed in one ofthe biggest communication task captains that are of greathelp to guide sensor network design Figure 4 shows 119899-taskcommunication scheduling based on the queuing theorymodel in the wireless sensor network
Input process communication tasks are divided into 119873
levels The first level has the highest priority the secondpriority has secondary priority and so forth The119873 level hasthe lowest priority Assume that each communication taskinterval is the Poisson distribution or negative exponentialdistribution The average time of the interval of the 119894th levelcommunication task is 120582
119894
Queuing rules the task responses as soon as the com-munication task arrival by the background task executioncall service when the task is not scheduling executed in thesystem The high-priority communication tasks priority isexecuted in sequence until the end of all high-priority tasksin the queue When the low-priority tasks are executing thehigh-priority task takes over the low-priority task and thelow-priority task will return to the queue the same prioritycommunication task followed by FCFS rues
Service process wireless sensor network uses the statemachine to drive communication task process assumingthat each time of the communication task is exponentialdistribution and the average service of level 119894 communicationtask rate is 120583
119894
The WSN communication tasks queue performanceparameters [21] (a) absolute throughput 119860 is the average
00 01 02 03
10
20
30
11
21
31
12
22
32
13
23
33
40 41 42 43
i
j
u21205822
1205822 1205822
1205822
1205822
12058221205822
1205822
1205822
u21205822
u21205822
12058311205821
1205831 12058311205821
12058311205821
12058311205821 12058311205821
12058311205821
1205821 1205821
1205821
1205821
1205831 1205821 1205821
middot middot middot
Figure 5 System state spaces and the transfer process
time of task service in the unit time (b) relative throughput119876 is the ratio of all the severed tasks and all request tasksin the unit time (c) the queue length of the average value119871119904is all communication tasks in the WSN (d) the queue
of average length 119871119902is the average number of the waiting
tasks in the queue (e) the average sojourn times 119882119904are the
average of the taskwaiting for service time119882119902and the average
service time 120591 (then 119882119904= 119882119902+ 120591) (f) busy period 119879
119887is the
random parameter (g) system loss rates 119875loss are the overflowprobability
5 Priority Queue with Two Classes of Tasks
Assume the queuing system is the preemptive priority The119894th task arrival is Poisson distribution with parameter 120582
119894
the service time is exponentially distributed with parameter120583(119894 = 1 2 ) Level 1th priority communication task ismore priority than level 2th priority task The system stateis 119864 = (119894 119895) 0 ⩽ 119894 0 ⩽ 119895 119894(119895) represents the 1(2) level ofthe communication tasksThe system state space distribution119875(119894 119895) = 119875
119894119895 0 ⩽ 119894 0 ⩽ 119895 The system transition process is
depicted in Figure 5
6 Tasks PerformanceIndicators in Sensor Network
The priority tasks processing is as follows when the 1stlevel task with parameters 120582
1and the 2nd level task with
parameters 1205822arrive service times of two level tasks are the
1205831and 120583
2 the taskrsquos priority is reduced in sequence and
they share the waiting queue The recursive calculation ofprobability matrix 119875
119894119895 0 ⩽ 119895 ⩽ 119873 needs a large amount
of calculation therefore Matlab software is the necessarysoftwareTheMM1 preemptive priority queuemodel is usedin the experiments The arrival of the 119894th level task process as
The Scientific World Journal 5
a Poisson distribution with the parameter 120582119894and service time
as a negative exponential distribution with the parameter120583119894(119894 = 1 2) The 1st level tasks are more priority than the
2nd level communication tasks Assume the parameters are1205821= 170 120582
2= 300 120583
1= 500 and 120583
2= 700
(1) Steady-State Queue Length Figure 6 shows the probabilityand the queue length as the 120583
2increasing The vertical axis
is the probability and the horizontal axis is the queue lengthIn the probability matrix 119875 = 0 the maximum queue lengthcan be obtained in the system and assures that taskrsquos buffer isenough to calculate the taskrsquos loss
In the simulation 119871119904= 40 which is the maximum queue
length when 119875 = 0 the arrivals of the taskrsquos probability are0 this means the possibility of task arrival does not exist andthe length does not grow Then when 119875 = 0 the length canbe regarded as the largest queue length(2) Average Sojourn Time Assume that every level of taskarrival is Poisson distribution The 119894th level tasks are withthe parameter 120582
119894 the service time is the negative exponential
distribution and the average service time is 1120583 The averagesojourn times 119882
1199041and 119882
1199042are calculated in the following
formulas
1199081199041=
1
120583 minus 1205821
1199081199021
= 1199081199041minus
1
120583=
1205821
120583 (120583 minus 1205821)
(1)
1199081199041= (1 +
1205821
1205822
) times (1
120583 minus 1205821minus 1205822
) minus1205821
1205822
times1
120583 minus 1205821
1199081199022
= 1199081199042minus
1
120583
(2)
(3) AverageWaiting Time [22]The sameway the queue of theaverage waiting times 119882
1199021and 119882
1199022is calculated as formula
(1)(4) Wireless Sensor Usage Rate [23] 119875 is the probability of thewireless sensor being idle then 120588 = 1 minus 119875 where 120588 is theoccupancy probability of communication task [24 25] Thegreater 120588 is the greater the occupancy probability is 120588 is theservice capacity or the load capacity To consider the prac-ticality of the model the queue length is not unlimited Todetermine the performance indicators we take the queuingmodel of MM1N and set the buffer capacity which is119898(5) Taskrsquos Throughput The communication taskrsquos time 119879 isdivide into three parts they are the taskrsquos processing time 119879
119894
the state machine processing time 119879119904 and the wireless sensor
idle time119879119903 119879119894+119879119904asymp 119879The taskrsquos processing is more priority
than the state machine processing Assume the tasks servicestrength is 120588
119894 then the tasks processing time is 119879
119894= 120588119894119879 and
the state machine processing time is 119879119904= (1 minus 120588
119894)119879
The processing of the finite automata is the queuingmodel ofMM1N the input processing with the parameter120582119904and the service time with the parameter 120583
119904are the
negative exponential distribution length of the buffer is 119899Theprocessing speed of the communication task is faster than
Queue length
Prob
abili
ty
0
005
01
015
02
5 10 15 20 25 30 35
1205821 = 190 1205822 = 230 1205831 = 450 1205832 = 500
1205821 = 220 1205822 = 230 1205831 = 450 1205832 = 500
1205821 = 170 1205822 = 300 1205831 = 500 1205832 = 500
1205821 = 100 1205822 = 230 1205831 = 450 1205832 = 500
Figure 6 Probability and queue length graph
the processing speed of the state machine Thus the actualprocessing capability of the state machine is 120583
119904119903= (1 minus 120588
119894)120583119904
and the buffer length is119898 then the loss rate is
119875lost =1 minus 120588119904119903
1 minus 120588119898+1119904119903
120588119898
119904119903 (3)
In particular 120588119904119903= 120582119904120583119904119903
As to formula (1) the calculation which the state machinethroughput computes is the following formula
1205820= 120582119904(1 minus
1 minus 120588119904119903
1 minus 120588119898+1119904119903
120588119898
119904119903) (4)
When the sensor network is severely overloading the120582119904≫ 120583119904119903 and the 120588
119904119903≫ 1 As to formula (2) formula (5) is
calculated due to formula (5) and the speed of the parameter120582119894affects the performance of the task processing the greater
120582119894is the lower the performance of the task processing is
When the communication tasks processing rate 120583119894and the
state machine processing rate 120583119903remain unchanged the
performance curve is a straight line in which the slope isminus120583119903120583119894 Consider
1205820asymp 120583119904119903= (1 minus 120588
119894) 120583119903= (1 minus
120582119894
120583119894
)120583119903 (5)
(6) Wireless Sensor Processing Capacity Assume the process-ing capacity is of119873mips the quantity of the tasks which needto be executed in the taskrsquos processing is 119862
1and the quantity
of the tasks which need to be executed in the state machineis1198622 then the taskrsquos processing capacity computes as formula
(3) formula (6) is as follows
120588119904119903=
120582119904
120583119904119903
=120582119894
(1 minus 120588119894) 120583119904
=120582119894
(1 minus (120582119894120583119894)) 120583119904
=120582119894
(1 minus (120582119894 (119873119862
1))) (119873119862
2)=
1205821198941198622
119873 minus 1205821198941198621
(6)
6 The Scientific World Journal
Table 1 Experimental parameters setting
Parameter L7-Filter SnortNum of RegExp 161 166Num of DFA states 1432 1257120573 (expression size) 256 256120595 (relevance frequency) [023 034] [023 034]120578 (match probability) [075 099] [075 099]120574 (similarity) [05 10] [05 10]
Take formula (6) into formula (3) the loss rate 119876 is
119876 = 119875lost =1 minus (120582
1198941198622 (119873 minus 120582
1198941198621))
1 minus [1205821198941198622 (119873 minus 120582
1198941198621)]119898+1
times(1205821198941198622)119898
[119873 minus 1205821198941198621]119898
=(1205821198941198622)119898
sum119898
119894=0[119873 minus 120582
1198941198621]119894
(1205821198941198622)119898minus119894
(7)
Formula (7) is the relationship between the loss rate andthe processing capacity It helps to determine the require-ments of the taskrsquos processing
7 Experiment
71 Experiment Set We evaluated our matching approachby regular expression sets extracted from two real-worldsystems named L7-Filter and Snort L7-Filter is famous opensource application layer traffic classier for LinuxThe payloadcontent of a flow and identified its application level protocolare reassembled through regular expression matching Snortis a well-known open-source intrusion detection systemwhich can be configured to performprotocol analysis probesand content inspecting over online traffic by detecting avariety of worms Two sets are chosen as 119877 = 119903
1 1199032 119903
119899
to perform the experiments The experiment parameters ESMP are set as shown in Table 1Then the local optimal valuecan be obtained during our experiments
Print size denotes the memory occupation of prints afterthe profiteering stage Group number is the group number ofcorrelative regular expression according to the parameter 120574Average similarity is the average value of similarity in eachgroup (see (2)) Package size is the testing packages lengthOur simulation environment is based on NS-2 (NetworkSimulator version 2) We set the number of nodes from 20 to100 Number of suspicious package is the number of packagethat needs to be verified after the profiteering stage Lastly wecalculate our experiment efficiency by their average executingcost Efficiency = (Num of suspicious packageTotal packageNumber) times (119865(119892
119894)Group Number)
Table 2 demonstrates that we can get a good efficiencypromotion from 7317 to 8973 A regular matchingcomparison was performed with our strategy and normalapproach The average hop and average 119865(119866
119894) variation
tendency and the number of nodes are shown in Figure 7L7-Filter and Snort were tested separately 119910-axis is hops and119909-axis indicates the nodes number From the results figure
Average hops on L7
010
50
40
30
20
10
20 30 40 50 60 70 80 90
Average hops on Snort
Nodes
10 20 30 40 50 60 70 80 90Nodes
Hops L7Hops L7 Gi
Hop
s
0
50
40
30
20
10
Hop
s
Hops SnortHops Snort Gi
Figure 7 Results of node average hops in NS-2
a significant difference can be observed when nodes aremorethan 30 the hops number of using 119866
119894decreases sharply
Figure 7 demonstrates that the matching approach cantest and verify the packages efficiently when the number ofwireless nodes is more than 30 which indicates that ourapproach can be well adapted to medium or large scaledistributed wireless sensor network On the other hand thereis no major difference in average hops when the system ishandling a small group of wireless nodes Comparing withother end-to-end strategies [9] our approach provides awell scalable way to construct intrusion detection systemby integrating distributed wireless sensor nodes Based onappropriate parameters network attacks can bemonitored byour system in an effective way
72 Experiment of Queue Model The experiment comparestwo groups of the performance results which computed bythe queuing theory and got the results from the softwareNS2 The NS2 platform simulated the STM32W108 sensornetworking we found that it is affected with the followingparameters the average length of stay for communicationtasks the average queue waiting time of tasks the occupancyrate and the task throughput
The Scientific World Journal 7
Table 2 Experimental data
Parameters
Results L7-Filter Snort1205781= 024
1205742= 077
1205951= 06
1205782= 026
1205742= 0831205952= 5
1205783= 036
1205743= 098
1205953= 10
1205781= 024
1205742= 077
1205951= 06
1205782= 026
1205742= 0831205952= 5
1205783= 036
1205743= 098
1205953= 10
Print size 015MB 031MB 012MB 025MB 039MB 024MBGroup number 14 17 11 14 15 12Average similarity 083 098 095 089 089 097Package size 1024 B 2048 B 4096 B 1024 B 2048 B 4096 BNumber of suspiciouspackage 253 83 122 41 114 48
Efficiency 8973 7317 765 831 7794 8535
Table 3 Experimental data statistics
Parameters
Indicator Queuing theory model calculation results NS2 simulation results1205821= 180 120582
2= 270
1205831= 1205832= 700
119898 = 100
1205821= 150 120582
2= 400
1205831= 1205832= 700
119898 = 35
1205821= 180
1205822= 400
119898 = 100
1205821= 150
1205822= 400
119898 = 35
Queue length 120 40 112 38
Average sojourn time(s) 1198821199041= 00019230
1198821199042= 0005385
1198821199041= 00018182
1198821199042= 0008485
1198821199041= 00018240
1198821199042= 0005062
1198821199041= 00016401
1198821199042= 000849
Average waiting time(s) 1198821199021
= 00004945
1198821199022
= 0004956
1198821199021
= 00003924
1198821199022
= 00069565
1198821199021
= 00003982
1198821199022
= 00045412
1198821199021
= 00002116
1198821199022
= 0006783
Wireless sensor usagerate 955 819 966 883
Sensor networkthroughput 436000 474300 453954 423561
Tasks loss rate 270677 0099 377 0098
Simulation software configuration communication taskstake the high-priority traffic and low-priority communica-tions task two categories Design the taskrsquos scheduling func-tion and assure 119862
1is approximately 400 operations and 119862
2is
about 4000 operationsThe program triggers communicationaccording to the different experimental parameters 120582 and119898 to test the influence on wireless sensor performanceThe experiment of the results compares with calculationresults of the method based on queuing theory to verifythe creditability of the method The statistics are shown inTable 3
When the sensor overloaded the sensor network handlesthe task for a long time and the state machine processing hasno support to the sensor network The actual speed of sensorprocessing 120583
119904119903is far less than 120583
119904 When the wireless sensor
network needed specific requirements 119905 of the loss rate andthe sensor throughput it can take the speed of the schedulingto the requirements
For formula (7) it can understand the relationshipbetween the loss rate and the capacity of scheduling It can
easily choose the right sensor in the network which willgreatly improve the quality of service
73 The Methods of Analysis The previous method of finiteautomata has discussed the regular expression matching sys-tem security in WSN and the evaluation of the performanceis ignored to research The matching method in some extentcan maintain the precision and accuracy in some systems itcan be used in a specific environment the performance of theevaluation in the wireless sensor network (WSN) that we hadresearched is in the universal environment it is necessary toconsider the problem of the restrictions such as the capacityof the buffer the length of the queue in the processing timethe performance of the calculation that needs enough bufferfor the task processing and the work conditions In ourresearch the approach which took the matching methodand the evaluating performance together is a new topic Themethod ensures maintaining the system security reducingthe loss rate of the communication task and improving theaccuracy of the scheduleThe universal approach can be used
8 The Scientific World Journal
in lots of environments in the wireless sensor network theapproach has a good excellent performance
8 Conclusions
This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth
The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model
Conflict of Interests
The authors declare that there is no conflict of interestsregarding the publication of this paper
Acknowledgments
This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)
References
[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014
[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002
[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002
[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003
[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011
[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of
the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999
[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011
[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008
[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005
[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011
[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014
[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013
[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012
[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006
[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012
[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008
[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006
[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006
[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007
[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001
[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000
[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational
The Scientific World Journal 9
approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009
[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011
[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009
[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010
Submit your manuscripts athttpwwwhindawicom
Computer Games Technology
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Distributed Sensor Networks
International Journal of
Advances in
FuzzySystems
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014
International Journal of
ReconfigurableComputing
Hindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Applied Computational Intelligence and Soft Computing
thinspAdvancesthinspinthinsp
Artificial Intelligence
HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014
Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Electrical and Computer Engineering
Journal of
Journal of
Computer Networks and Communications
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporation
httpwwwhindawicom Volume 2014
Advances in
Multimedia
International Journal of
Biomedical Imaging
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
ArtificialNeural Systems
Advances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
RoboticsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Computational Intelligence and Neuroscience
Industrial EngineeringJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Human-ComputerInteraction
Advances in
Computer EngineeringAdvances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
4 The Scientific World Journal
IE IE IEINI0 INI1 INIn
d (x gt 2 y lt 3)
e (x gt
5 ygt 4)
y =
0
a (x lt 2) y = 0
f (x gt 2 y gt 4)
b (xgt2)
ex=
=0y
0
middot middot middot
c (x = 2) y = 0 S0
S1
S2
S3 S4 S5
Figure 4Queuing theorymodel of thewireless sensor networkwith119899 communication taskrsquos scheduling
the queue and executes the task scheduling function Thismodel greatly reduces the tasksrsquo loss thus determining thewireless sensor network (WSN) which is formed in one ofthe biggest communication task captains that are of greathelp to guide sensor network design Figure 4 shows 119899-taskcommunication scheduling based on the queuing theorymodel in the wireless sensor network
Input process communication tasks are divided into 119873
levels The first level has the highest priority the secondpriority has secondary priority and so forth The119873 level hasthe lowest priority Assume that each communication taskinterval is the Poisson distribution or negative exponentialdistribution The average time of the interval of the 119894th levelcommunication task is 120582
119894
Queuing rules the task responses as soon as the com-munication task arrival by the background task executioncall service when the task is not scheduling executed in thesystem The high-priority communication tasks priority isexecuted in sequence until the end of all high-priority tasksin the queue When the low-priority tasks are executing thehigh-priority task takes over the low-priority task and thelow-priority task will return to the queue the same prioritycommunication task followed by FCFS rues
Service process wireless sensor network uses the statemachine to drive communication task process assumingthat each time of the communication task is exponentialdistribution and the average service of level 119894 communicationtask rate is 120583
119894
The WSN communication tasks queue performanceparameters [21] (a) absolute throughput 119860 is the average
00 01 02 03
10
20
30
11
21
31
12
22
32
13
23
33
40 41 42 43
i
j
u21205822
1205822 1205822
1205822
1205822
12058221205822
1205822
1205822
u21205822
u21205822
12058311205821
1205831 12058311205821
12058311205821
12058311205821 12058311205821
12058311205821
1205821 1205821
1205821
1205821
1205831 1205821 1205821
middot middot middot
Figure 5 System state spaces and the transfer process
time of task service in the unit time (b) relative throughput119876 is the ratio of all the severed tasks and all request tasksin the unit time (c) the queue length of the average value119871119904is all communication tasks in the WSN (d) the queue
of average length 119871119902is the average number of the waiting
tasks in the queue (e) the average sojourn times 119882119904are the
average of the taskwaiting for service time119882119902and the average
service time 120591 (then 119882119904= 119882119902+ 120591) (f) busy period 119879
119887is the
random parameter (g) system loss rates 119875loss are the overflowprobability
5 Priority Queue with Two Classes of Tasks
Assume the queuing system is the preemptive priority The119894th task arrival is Poisson distribution with parameter 120582
119894
the service time is exponentially distributed with parameter120583(119894 = 1 2 ) Level 1th priority communication task ismore priority than level 2th priority task The system stateis 119864 = (119894 119895) 0 ⩽ 119894 0 ⩽ 119895 119894(119895) represents the 1(2) level ofthe communication tasksThe system state space distribution119875(119894 119895) = 119875
119894119895 0 ⩽ 119894 0 ⩽ 119895 The system transition process is
depicted in Figure 5
6 Tasks PerformanceIndicators in Sensor Network
The priority tasks processing is as follows when the 1stlevel task with parameters 120582
1and the 2nd level task with
parameters 1205822arrive service times of two level tasks are the
1205831and 120583
2 the taskrsquos priority is reduced in sequence and
they share the waiting queue The recursive calculation ofprobability matrix 119875
119894119895 0 ⩽ 119895 ⩽ 119873 needs a large amount
of calculation therefore Matlab software is the necessarysoftwareTheMM1 preemptive priority queuemodel is usedin the experiments The arrival of the 119894th level task process as
The Scientific World Journal 5
a Poisson distribution with the parameter 120582119894and service time
as a negative exponential distribution with the parameter120583119894(119894 = 1 2) The 1st level tasks are more priority than the
2nd level communication tasks Assume the parameters are1205821= 170 120582
2= 300 120583
1= 500 and 120583
2= 700
(1) Steady-State Queue Length Figure 6 shows the probabilityand the queue length as the 120583
2increasing The vertical axis
is the probability and the horizontal axis is the queue lengthIn the probability matrix 119875 = 0 the maximum queue lengthcan be obtained in the system and assures that taskrsquos buffer isenough to calculate the taskrsquos loss
In the simulation 119871119904= 40 which is the maximum queue
length when 119875 = 0 the arrivals of the taskrsquos probability are0 this means the possibility of task arrival does not exist andthe length does not grow Then when 119875 = 0 the length canbe regarded as the largest queue length(2) Average Sojourn Time Assume that every level of taskarrival is Poisson distribution The 119894th level tasks are withthe parameter 120582
119894 the service time is the negative exponential
distribution and the average service time is 1120583 The averagesojourn times 119882
1199041and 119882
1199042are calculated in the following
formulas
1199081199041=
1
120583 minus 1205821
1199081199021
= 1199081199041minus
1
120583=
1205821
120583 (120583 minus 1205821)
(1)
1199081199041= (1 +
1205821
1205822
) times (1
120583 minus 1205821minus 1205822
) minus1205821
1205822
times1
120583 minus 1205821
1199081199022
= 1199081199042minus
1
120583
(2)
(3) AverageWaiting Time [22]The sameway the queue of theaverage waiting times 119882
1199021and 119882
1199022is calculated as formula
(1)(4) Wireless Sensor Usage Rate [23] 119875 is the probability of thewireless sensor being idle then 120588 = 1 minus 119875 where 120588 is theoccupancy probability of communication task [24 25] Thegreater 120588 is the greater the occupancy probability is 120588 is theservice capacity or the load capacity To consider the prac-ticality of the model the queue length is not unlimited Todetermine the performance indicators we take the queuingmodel of MM1N and set the buffer capacity which is119898(5) Taskrsquos Throughput The communication taskrsquos time 119879 isdivide into three parts they are the taskrsquos processing time 119879
119894
the state machine processing time 119879119904 and the wireless sensor
idle time119879119903 119879119894+119879119904asymp 119879The taskrsquos processing is more priority
than the state machine processing Assume the tasks servicestrength is 120588
119894 then the tasks processing time is 119879
119894= 120588119894119879 and
the state machine processing time is 119879119904= (1 minus 120588
119894)119879
The processing of the finite automata is the queuingmodel ofMM1N the input processing with the parameter120582119904and the service time with the parameter 120583
119904are the
negative exponential distribution length of the buffer is 119899Theprocessing speed of the communication task is faster than
Queue length
Prob
abili
ty
0
005
01
015
02
5 10 15 20 25 30 35
1205821 = 190 1205822 = 230 1205831 = 450 1205832 = 500
1205821 = 220 1205822 = 230 1205831 = 450 1205832 = 500
1205821 = 170 1205822 = 300 1205831 = 500 1205832 = 500
1205821 = 100 1205822 = 230 1205831 = 450 1205832 = 500
Figure 6 Probability and queue length graph
the processing speed of the state machine Thus the actualprocessing capability of the state machine is 120583
119904119903= (1 minus 120588
119894)120583119904
and the buffer length is119898 then the loss rate is
119875lost =1 minus 120588119904119903
1 minus 120588119898+1119904119903
120588119898
119904119903 (3)
In particular 120588119904119903= 120582119904120583119904119903
As to formula (1) the calculation which the state machinethroughput computes is the following formula
1205820= 120582119904(1 minus
1 minus 120588119904119903
1 minus 120588119898+1119904119903
120588119898
119904119903) (4)
When the sensor network is severely overloading the120582119904≫ 120583119904119903 and the 120588
119904119903≫ 1 As to formula (2) formula (5) is
calculated due to formula (5) and the speed of the parameter120582119894affects the performance of the task processing the greater
120582119894is the lower the performance of the task processing is
When the communication tasks processing rate 120583119894and the
state machine processing rate 120583119903remain unchanged the
performance curve is a straight line in which the slope isminus120583119903120583119894 Consider
1205820asymp 120583119904119903= (1 minus 120588
119894) 120583119903= (1 minus
120582119894
120583119894
)120583119903 (5)
(6) Wireless Sensor Processing Capacity Assume the process-ing capacity is of119873mips the quantity of the tasks which needto be executed in the taskrsquos processing is 119862
1and the quantity
of the tasks which need to be executed in the state machineis1198622 then the taskrsquos processing capacity computes as formula
(3) formula (6) is as follows
120588119904119903=
120582119904
120583119904119903
=120582119894
(1 minus 120588119894) 120583119904
=120582119894
(1 minus (120582119894120583119894)) 120583119904
=120582119894
(1 minus (120582119894 (119873119862
1))) (119873119862
2)=
1205821198941198622
119873 minus 1205821198941198621
(6)
6 The Scientific World Journal
Table 1 Experimental parameters setting
Parameter L7-Filter SnortNum of RegExp 161 166Num of DFA states 1432 1257120573 (expression size) 256 256120595 (relevance frequency) [023 034] [023 034]120578 (match probability) [075 099] [075 099]120574 (similarity) [05 10] [05 10]
Take formula (6) into formula (3) the loss rate 119876 is
119876 = 119875lost =1 minus (120582
1198941198622 (119873 minus 120582
1198941198621))
1 minus [1205821198941198622 (119873 minus 120582
1198941198621)]119898+1
times(1205821198941198622)119898
[119873 minus 1205821198941198621]119898
=(1205821198941198622)119898
sum119898
119894=0[119873 minus 120582
1198941198621]119894
(1205821198941198622)119898minus119894
(7)
Formula (7) is the relationship between the loss rate andthe processing capacity It helps to determine the require-ments of the taskrsquos processing
7 Experiment
71 Experiment Set We evaluated our matching approachby regular expression sets extracted from two real-worldsystems named L7-Filter and Snort L7-Filter is famous opensource application layer traffic classier for LinuxThe payloadcontent of a flow and identified its application level protocolare reassembled through regular expression matching Snortis a well-known open-source intrusion detection systemwhich can be configured to performprotocol analysis probesand content inspecting over online traffic by detecting avariety of worms Two sets are chosen as 119877 = 119903
1 1199032 119903
119899
to perform the experiments The experiment parameters ESMP are set as shown in Table 1Then the local optimal valuecan be obtained during our experiments
Print size denotes the memory occupation of prints afterthe profiteering stage Group number is the group number ofcorrelative regular expression according to the parameter 120574Average similarity is the average value of similarity in eachgroup (see (2)) Package size is the testing packages lengthOur simulation environment is based on NS-2 (NetworkSimulator version 2) We set the number of nodes from 20 to100 Number of suspicious package is the number of packagethat needs to be verified after the profiteering stage Lastly wecalculate our experiment efficiency by their average executingcost Efficiency = (Num of suspicious packageTotal packageNumber) times (119865(119892
119894)Group Number)
Table 2 demonstrates that we can get a good efficiencypromotion from 7317 to 8973 A regular matchingcomparison was performed with our strategy and normalapproach The average hop and average 119865(119866
119894) variation
tendency and the number of nodes are shown in Figure 7L7-Filter and Snort were tested separately 119910-axis is hops and119909-axis indicates the nodes number From the results figure
Average hops on L7
010
50
40
30
20
10
20 30 40 50 60 70 80 90
Average hops on Snort
Nodes
10 20 30 40 50 60 70 80 90Nodes
Hops L7Hops L7 Gi
Hop
s
0
50
40
30
20
10
Hop
s
Hops SnortHops Snort Gi
Figure 7 Results of node average hops in NS-2
a significant difference can be observed when nodes aremorethan 30 the hops number of using 119866
119894decreases sharply
Figure 7 demonstrates that the matching approach cantest and verify the packages efficiently when the number ofwireless nodes is more than 30 which indicates that ourapproach can be well adapted to medium or large scaledistributed wireless sensor network On the other hand thereis no major difference in average hops when the system ishandling a small group of wireless nodes Comparing withother end-to-end strategies [9] our approach provides awell scalable way to construct intrusion detection systemby integrating distributed wireless sensor nodes Based onappropriate parameters network attacks can bemonitored byour system in an effective way
72 Experiment of Queue Model The experiment comparestwo groups of the performance results which computed bythe queuing theory and got the results from the softwareNS2 The NS2 platform simulated the STM32W108 sensornetworking we found that it is affected with the followingparameters the average length of stay for communicationtasks the average queue waiting time of tasks the occupancyrate and the task throughput
The Scientific World Journal 7
Table 2 Experimental data
Parameters
Results L7-Filter Snort1205781= 024
1205742= 077
1205951= 06
1205782= 026
1205742= 0831205952= 5
1205783= 036
1205743= 098
1205953= 10
1205781= 024
1205742= 077
1205951= 06
1205782= 026
1205742= 0831205952= 5
1205783= 036
1205743= 098
1205953= 10
Print size 015MB 031MB 012MB 025MB 039MB 024MBGroup number 14 17 11 14 15 12Average similarity 083 098 095 089 089 097Package size 1024 B 2048 B 4096 B 1024 B 2048 B 4096 BNumber of suspiciouspackage 253 83 122 41 114 48
Efficiency 8973 7317 765 831 7794 8535
Table 3 Experimental data statistics
Parameters
Indicator Queuing theory model calculation results NS2 simulation results1205821= 180 120582
2= 270
1205831= 1205832= 700
119898 = 100
1205821= 150 120582
2= 400
1205831= 1205832= 700
119898 = 35
1205821= 180
1205822= 400
119898 = 100
1205821= 150
1205822= 400
119898 = 35
Queue length 120 40 112 38
Average sojourn time(s) 1198821199041= 00019230
1198821199042= 0005385
1198821199041= 00018182
1198821199042= 0008485
1198821199041= 00018240
1198821199042= 0005062
1198821199041= 00016401
1198821199042= 000849
Average waiting time(s) 1198821199021
= 00004945
1198821199022
= 0004956
1198821199021
= 00003924
1198821199022
= 00069565
1198821199021
= 00003982
1198821199022
= 00045412
1198821199021
= 00002116
1198821199022
= 0006783
Wireless sensor usagerate 955 819 966 883
Sensor networkthroughput 436000 474300 453954 423561
Tasks loss rate 270677 0099 377 0098
Simulation software configuration communication taskstake the high-priority traffic and low-priority communica-tions task two categories Design the taskrsquos scheduling func-tion and assure 119862
1is approximately 400 operations and 119862
2is
about 4000 operationsThe program triggers communicationaccording to the different experimental parameters 120582 and119898 to test the influence on wireless sensor performanceThe experiment of the results compares with calculationresults of the method based on queuing theory to verifythe creditability of the method The statistics are shown inTable 3
When the sensor overloaded the sensor network handlesthe task for a long time and the state machine processing hasno support to the sensor network The actual speed of sensorprocessing 120583
119904119903is far less than 120583
119904 When the wireless sensor
network needed specific requirements 119905 of the loss rate andthe sensor throughput it can take the speed of the schedulingto the requirements
For formula (7) it can understand the relationshipbetween the loss rate and the capacity of scheduling It can
easily choose the right sensor in the network which willgreatly improve the quality of service
73 The Methods of Analysis The previous method of finiteautomata has discussed the regular expression matching sys-tem security in WSN and the evaluation of the performanceis ignored to research The matching method in some extentcan maintain the precision and accuracy in some systems itcan be used in a specific environment the performance of theevaluation in the wireless sensor network (WSN) that we hadresearched is in the universal environment it is necessary toconsider the problem of the restrictions such as the capacityof the buffer the length of the queue in the processing timethe performance of the calculation that needs enough bufferfor the task processing and the work conditions In ourresearch the approach which took the matching methodand the evaluating performance together is a new topic Themethod ensures maintaining the system security reducingthe loss rate of the communication task and improving theaccuracy of the scheduleThe universal approach can be used
8 The Scientific World Journal
in lots of environments in the wireless sensor network theapproach has a good excellent performance
8 Conclusions
This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth
The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model
Conflict of Interests
The authors declare that there is no conflict of interestsregarding the publication of this paper
Acknowledgments
This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)
References
[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014
[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002
[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002
[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003
[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011
[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of
the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999
[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011
[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008
[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005
[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011
[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014
[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013
[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012
[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006
[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012
[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008
[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006
[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006
[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007
[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001
[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000
[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational
The Scientific World Journal 9
approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009
[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011
[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009
[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010
Submit your manuscripts athttpwwwhindawicom
Computer Games Technology
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Distributed Sensor Networks
International Journal of
Advances in
FuzzySystems
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014
International Journal of
ReconfigurableComputing
Hindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Applied Computational Intelligence and Soft Computing
thinspAdvancesthinspinthinsp
Artificial Intelligence
HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014
Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Electrical and Computer Engineering
Journal of
Journal of
Computer Networks and Communications
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporation
httpwwwhindawicom Volume 2014
Advances in
Multimedia
International Journal of
Biomedical Imaging
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
ArtificialNeural Systems
Advances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
RoboticsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Computational Intelligence and Neuroscience
Industrial EngineeringJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Human-ComputerInteraction
Advances in
Computer EngineeringAdvances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World Journal 5
a Poisson distribution with the parameter 120582119894and service time
as a negative exponential distribution with the parameter120583119894(119894 = 1 2) The 1st level tasks are more priority than the
2nd level communication tasks Assume the parameters are1205821= 170 120582
2= 300 120583
1= 500 and 120583
2= 700
(1) Steady-State Queue Length Figure 6 shows the probabilityand the queue length as the 120583
2increasing The vertical axis
is the probability and the horizontal axis is the queue lengthIn the probability matrix 119875 = 0 the maximum queue lengthcan be obtained in the system and assures that taskrsquos buffer isenough to calculate the taskrsquos loss
In the simulation 119871119904= 40 which is the maximum queue
length when 119875 = 0 the arrivals of the taskrsquos probability are0 this means the possibility of task arrival does not exist andthe length does not grow Then when 119875 = 0 the length canbe regarded as the largest queue length(2) Average Sojourn Time Assume that every level of taskarrival is Poisson distribution The 119894th level tasks are withthe parameter 120582
119894 the service time is the negative exponential
distribution and the average service time is 1120583 The averagesojourn times 119882
1199041and 119882
1199042are calculated in the following
formulas
1199081199041=
1
120583 minus 1205821
1199081199021
= 1199081199041minus
1
120583=
1205821
120583 (120583 minus 1205821)
(1)
1199081199041= (1 +
1205821
1205822
) times (1
120583 minus 1205821minus 1205822
) minus1205821
1205822
times1
120583 minus 1205821
1199081199022
= 1199081199042minus
1
120583
(2)
(3) AverageWaiting Time [22]The sameway the queue of theaverage waiting times 119882
1199021and 119882
1199022is calculated as formula
(1)(4) Wireless Sensor Usage Rate [23] 119875 is the probability of thewireless sensor being idle then 120588 = 1 minus 119875 where 120588 is theoccupancy probability of communication task [24 25] Thegreater 120588 is the greater the occupancy probability is 120588 is theservice capacity or the load capacity To consider the prac-ticality of the model the queue length is not unlimited Todetermine the performance indicators we take the queuingmodel of MM1N and set the buffer capacity which is119898(5) Taskrsquos Throughput The communication taskrsquos time 119879 isdivide into three parts they are the taskrsquos processing time 119879
119894
the state machine processing time 119879119904 and the wireless sensor
idle time119879119903 119879119894+119879119904asymp 119879The taskrsquos processing is more priority
than the state machine processing Assume the tasks servicestrength is 120588
119894 then the tasks processing time is 119879
119894= 120588119894119879 and
the state machine processing time is 119879119904= (1 minus 120588
119894)119879
The processing of the finite automata is the queuingmodel ofMM1N the input processing with the parameter120582119904and the service time with the parameter 120583
119904are the
negative exponential distribution length of the buffer is 119899Theprocessing speed of the communication task is faster than
Queue length
Prob
abili
ty
0
005
01
015
02
5 10 15 20 25 30 35
1205821 = 190 1205822 = 230 1205831 = 450 1205832 = 500
1205821 = 220 1205822 = 230 1205831 = 450 1205832 = 500
1205821 = 170 1205822 = 300 1205831 = 500 1205832 = 500
1205821 = 100 1205822 = 230 1205831 = 450 1205832 = 500
Figure 6 Probability and queue length graph
the processing speed of the state machine Thus the actualprocessing capability of the state machine is 120583
119904119903= (1 minus 120588
119894)120583119904
and the buffer length is119898 then the loss rate is
119875lost =1 minus 120588119904119903
1 minus 120588119898+1119904119903
120588119898
119904119903 (3)
In particular 120588119904119903= 120582119904120583119904119903
As to formula (1) the calculation which the state machinethroughput computes is the following formula
1205820= 120582119904(1 minus
1 minus 120588119904119903
1 minus 120588119898+1119904119903
120588119898
119904119903) (4)
When the sensor network is severely overloading the120582119904≫ 120583119904119903 and the 120588
119904119903≫ 1 As to formula (2) formula (5) is
calculated due to formula (5) and the speed of the parameter120582119894affects the performance of the task processing the greater
120582119894is the lower the performance of the task processing is
When the communication tasks processing rate 120583119894and the
state machine processing rate 120583119903remain unchanged the
performance curve is a straight line in which the slope isminus120583119903120583119894 Consider
1205820asymp 120583119904119903= (1 minus 120588
119894) 120583119903= (1 minus
120582119894
120583119894
)120583119903 (5)
(6) Wireless Sensor Processing Capacity Assume the process-ing capacity is of119873mips the quantity of the tasks which needto be executed in the taskrsquos processing is 119862
1and the quantity
of the tasks which need to be executed in the state machineis1198622 then the taskrsquos processing capacity computes as formula
(3) formula (6) is as follows
120588119904119903=
120582119904
120583119904119903
=120582119894
(1 minus 120588119894) 120583119904
=120582119894
(1 minus (120582119894120583119894)) 120583119904
=120582119894
(1 minus (120582119894 (119873119862
1))) (119873119862
2)=
1205821198941198622
119873 minus 1205821198941198621
(6)
6 The Scientific World Journal
Table 1 Experimental parameters setting
Parameter L7-Filter SnortNum of RegExp 161 166Num of DFA states 1432 1257120573 (expression size) 256 256120595 (relevance frequency) [023 034] [023 034]120578 (match probability) [075 099] [075 099]120574 (similarity) [05 10] [05 10]
Take formula (6) into formula (3) the loss rate 119876 is
119876 = 119875lost =1 minus (120582
1198941198622 (119873 minus 120582
1198941198621))
1 minus [1205821198941198622 (119873 minus 120582
1198941198621)]119898+1
times(1205821198941198622)119898
[119873 minus 1205821198941198621]119898
=(1205821198941198622)119898
sum119898
119894=0[119873 minus 120582
1198941198621]119894
(1205821198941198622)119898minus119894
(7)
Formula (7) is the relationship between the loss rate andthe processing capacity It helps to determine the require-ments of the taskrsquos processing
7 Experiment
71 Experiment Set We evaluated our matching approachby regular expression sets extracted from two real-worldsystems named L7-Filter and Snort L7-Filter is famous opensource application layer traffic classier for LinuxThe payloadcontent of a flow and identified its application level protocolare reassembled through regular expression matching Snortis a well-known open-source intrusion detection systemwhich can be configured to performprotocol analysis probesand content inspecting over online traffic by detecting avariety of worms Two sets are chosen as 119877 = 119903
1 1199032 119903
119899
to perform the experiments The experiment parameters ESMP are set as shown in Table 1Then the local optimal valuecan be obtained during our experiments
Print size denotes the memory occupation of prints afterthe profiteering stage Group number is the group number ofcorrelative regular expression according to the parameter 120574Average similarity is the average value of similarity in eachgroup (see (2)) Package size is the testing packages lengthOur simulation environment is based on NS-2 (NetworkSimulator version 2) We set the number of nodes from 20 to100 Number of suspicious package is the number of packagethat needs to be verified after the profiteering stage Lastly wecalculate our experiment efficiency by their average executingcost Efficiency = (Num of suspicious packageTotal packageNumber) times (119865(119892
119894)Group Number)
Table 2 demonstrates that we can get a good efficiencypromotion from 7317 to 8973 A regular matchingcomparison was performed with our strategy and normalapproach The average hop and average 119865(119866
119894) variation
tendency and the number of nodes are shown in Figure 7L7-Filter and Snort were tested separately 119910-axis is hops and119909-axis indicates the nodes number From the results figure
Average hops on L7
010
50
40
30
20
10
20 30 40 50 60 70 80 90
Average hops on Snort
Nodes
10 20 30 40 50 60 70 80 90Nodes
Hops L7Hops L7 Gi
Hop
s
0
50
40
30
20
10
Hop
s
Hops SnortHops Snort Gi
Figure 7 Results of node average hops in NS-2
a significant difference can be observed when nodes aremorethan 30 the hops number of using 119866
119894decreases sharply
Figure 7 demonstrates that the matching approach cantest and verify the packages efficiently when the number ofwireless nodes is more than 30 which indicates that ourapproach can be well adapted to medium or large scaledistributed wireless sensor network On the other hand thereis no major difference in average hops when the system ishandling a small group of wireless nodes Comparing withother end-to-end strategies [9] our approach provides awell scalable way to construct intrusion detection systemby integrating distributed wireless sensor nodes Based onappropriate parameters network attacks can bemonitored byour system in an effective way
72 Experiment of Queue Model The experiment comparestwo groups of the performance results which computed bythe queuing theory and got the results from the softwareNS2 The NS2 platform simulated the STM32W108 sensornetworking we found that it is affected with the followingparameters the average length of stay for communicationtasks the average queue waiting time of tasks the occupancyrate and the task throughput
The Scientific World Journal 7
Table 2 Experimental data
Parameters
Results L7-Filter Snort1205781= 024
1205742= 077
1205951= 06
1205782= 026
1205742= 0831205952= 5
1205783= 036
1205743= 098
1205953= 10
1205781= 024
1205742= 077
1205951= 06
1205782= 026
1205742= 0831205952= 5
1205783= 036
1205743= 098
1205953= 10
Print size 015MB 031MB 012MB 025MB 039MB 024MBGroup number 14 17 11 14 15 12Average similarity 083 098 095 089 089 097Package size 1024 B 2048 B 4096 B 1024 B 2048 B 4096 BNumber of suspiciouspackage 253 83 122 41 114 48
Efficiency 8973 7317 765 831 7794 8535
Table 3 Experimental data statistics
Parameters
Indicator Queuing theory model calculation results NS2 simulation results1205821= 180 120582
2= 270
1205831= 1205832= 700
119898 = 100
1205821= 150 120582
2= 400
1205831= 1205832= 700
119898 = 35
1205821= 180
1205822= 400
119898 = 100
1205821= 150
1205822= 400
119898 = 35
Queue length 120 40 112 38
Average sojourn time(s) 1198821199041= 00019230
1198821199042= 0005385
1198821199041= 00018182
1198821199042= 0008485
1198821199041= 00018240
1198821199042= 0005062
1198821199041= 00016401
1198821199042= 000849
Average waiting time(s) 1198821199021
= 00004945
1198821199022
= 0004956
1198821199021
= 00003924
1198821199022
= 00069565
1198821199021
= 00003982
1198821199022
= 00045412
1198821199021
= 00002116
1198821199022
= 0006783
Wireless sensor usagerate 955 819 966 883
Sensor networkthroughput 436000 474300 453954 423561
Tasks loss rate 270677 0099 377 0098
Simulation software configuration communication taskstake the high-priority traffic and low-priority communica-tions task two categories Design the taskrsquos scheduling func-tion and assure 119862
1is approximately 400 operations and 119862
2is
about 4000 operationsThe program triggers communicationaccording to the different experimental parameters 120582 and119898 to test the influence on wireless sensor performanceThe experiment of the results compares with calculationresults of the method based on queuing theory to verifythe creditability of the method The statistics are shown inTable 3
When the sensor overloaded the sensor network handlesthe task for a long time and the state machine processing hasno support to the sensor network The actual speed of sensorprocessing 120583
119904119903is far less than 120583
119904 When the wireless sensor
network needed specific requirements 119905 of the loss rate andthe sensor throughput it can take the speed of the schedulingto the requirements
For formula (7) it can understand the relationshipbetween the loss rate and the capacity of scheduling It can
easily choose the right sensor in the network which willgreatly improve the quality of service
73 The Methods of Analysis The previous method of finiteautomata has discussed the regular expression matching sys-tem security in WSN and the evaluation of the performanceis ignored to research The matching method in some extentcan maintain the precision and accuracy in some systems itcan be used in a specific environment the performance of theevaluation in the wireless sensor network (WSN) that we hadresearched is in the universal environment it is necessary toconsider the problem of the restrictions such as the capacityof the buffer the length of the queue in the processing timethe performance of the calculation that needs enough bufferfor the task processing and the work conditions In ourresearch the approach which took the matching methodand the evaluating performance together is a new topic Themethod ensures maintaining the system security reducingthe loss rate of the communication task and improving theaccuracy of the scheduleThe universal approach can be used
8 The Scientific World Journal
in lots of environments in the wireless sensor network theapproach has a good excellent performance
8 Conclusions
This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth
The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model
Conflict of Interests
The authors declare that there is no conflict of interestsregarding the publication of this paper
Acknowledgments
This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)
References
[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014
[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002
[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002
[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003
[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011
[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of
the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999
[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011
[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008
[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005
[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011
[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014
[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013
[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012
[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006
[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012
[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008
[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006
[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006
[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007
[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001
[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000
[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational
The Scientific World Journal 9
approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009
[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011
[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009
[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010
Submit your manuscripts athttpwwwhindawicom
Computer Games Technology
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Distributed Sensor Networks
International Journal of
Advances in
FuzzySystems
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014
International Journal of
ReconfigurableComputing
Hindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Applied Computational Intelligence and Soft Computing
thinspAdvancesthinspinthinsp
Artificial Intelligence
HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014
Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Electrical and Computer Engineering
Journal of
Journal of
Computer Networks and Communications
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporation
httpwwwhindawicom Volume 2014
Advances in
Multimedia
International Journal of
Biomedical Imaging
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
ArtificialNeural Systems
Advances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
RoboticsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Computational Intelligence and Neuroscience
Industrial EngineeringJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Human-ComputerInteraction
Advances in
Computer EngineeringAdvances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
6 The Scientific World Journal
Table 1 Experimental parameters setting
Parameter L7-Filter SnortNum of RegExp 161 166Num of DFA states 1432 1257120573 (expression size) 256 256120595 (relevance frequency) [023 034] [023 034]120578 (match probability) [075 099] [075 099]120574 (similarity) [05 10] [05 10]
Take formula (6) into formula (3) the loss rate 119876 is
119876 = 119875lost =1 minus (120582
1198941198622 (119873 minus 120582
1198941198621))
1 minus [1205821198941198622 (119873 minus 120582
1198941198621)]119898+1
times(1205821198941198622)119898
[119873 minus 1205821198941198621]119898
=(1205821198941198622)119898
sum119898
119894=0[119873 minus 120582
1198941198621]119894
(1205821198941198622)119898minus119894
(7)
Formula (7) is the relationship between the loss rate andthe processing capacity It helps to determine the require-ments of the taskrsquos processing
7 Experiment
71 Experiment Set We evaluated our matching approachby regular expression sets extracted from two real-worldsystems named L7-Filter and Snort L7-Filter is famous opensource application layer traffic classier for LinuxThe payloadcontent of a flow and identified its application level protocolare reassembled through regular expression matching Snortis a well-known open-source intrusion detection systemwhich can be configured to performprotocol analysis probesand content inspecting over online traffic by detecting avariety of worms Two sets are chosen as 119877 = 119903
1 1199032 119903
119899
to perform the experiments The experiment parameters ESMP are set as shown in Table 1Then the local optimal valuecan be obtained during our experiments
Print size denotes the memory occupation of prints afterthe profiteering stage Group number is the group number ofcorrelative regular expression according to the parameter 120574Average similarity is the average value of similarity in eachgroup (see (2)) Package size is the testing packages lengthOur simulation environment is based on NS-2 (NetworkSimulator version 2) We set the number of nodes from 20 to100 Number of suspicious package is the number of packagethat needs to be verified after the profiteering stage Lastly wecalculate our experiment efficiency by their average executingcost Efficiency = (Num of suspicious packageTotal packageNumber) times (119865(119892
119894)Group Number)
Table 2 demonstrates that we can get a good efficiencypromotion from 7317 to 8973 A regular matchingcomparison was performed with our strategy and normalapproach The average hop and average 119865(119866
119894) variation
tendency and the number of nodes are shown in Figure 7L7-Filter and Snort were tested separately 119910-axis is hops and119909-axis indicates the nodes number From the results figure
Average hops on L7
010
50
40
30
20
10
20 30 40 50 60 70 80 90
Average hops on Snort
Nodes
10 20 30 40 50 60 70 80 90Nodes
Hops L7Hops L7 Gi
Hop
s
0
50
40
30
20
10
Hop
s
Hops SnortHops Snort Gi
Figure 7 Results of node average hops in NS-2
a significant difference can be observed when nodes aremorethan 30 the hops number of using 119866
119894decreases sharply
Figure 7 demonstrates that the matching approach cantest and verify the packages efficiently when the number ofwireless nodes is more than 30 which indicates that ourapproach can be well adapted to medium or large scaledistributed wireless sensor network On the other hand thereis no major difference in average hops when the system ishandling a small group of wireless nodes Comparing withother end-to-end strategies [9] our approach provides awell scalable way to construct intrusion detection systemby integrating distributed wireless sensor nodes Based onappropriate parameters network attacks can bemonitored byour system in an effective way
72 Experiment of Queue Model The experiment comparestwo groups of the performance results which computed bythe queuing theory and got the results from the softwareNS2 The NS2 platform simulated the STM32W108 sensornetworking we found that it is affected with the followingparameters the average length of stay for communicationtasks the average queue waiting time of tasks the occupancyrate and the task throughput
The Scientific World Journal 7
Table 2 Experimental data
Parameters
Results L7-Filter Snort1205781= 024
1205742= 077
1205951= 06
1205782= 026
1205742= 0831205952= 5
1205783= 036
1205743= 098
1205953= 10
1205781= 024
1205742= 077
1205951= 06
1205782= 026
1205742= 0831205952= 5
1205783= 036
1205743= 098
1205953= 10
Print size 015MB 031MB 012MB 025MB 039MB 024MBGroup number 14 17 11 14 15 12Average similarity 083 098 095 089 089 097Package size 1024 B 2048 B 4096 B 1024 B 2048 B 4096 BNumber of suspiciouspackage 253 83 122 41 114 48
Efficiency 8973 7317 765 831 7794 8535
Table 3 Experimental data statistics
Parameters
Indicator Queuing theory model calculation results NS2 simulation results1205821= 180 120582
2= 270
1205831= 1205832= 700
119898 = 100
1205821= 150 120582
2= 400
1205831= 1205832= 700
119898 = 35
1205821= 180
1205822= 400
119898 = 100
1205821= 150
1205822= 400
119898 = 35
Queue length 120 40 112 38
Average sojourn time(s) 1198821199041= 00019230
1198821199042= 0005385
1198821199041= 00018182
1198821199042= 0008485
1198821199041= 00018240
1198821199042= 0005062
1198821199041= 00016401
1198821199042= 000849
Average waiting time(s) 1198821199021
= 00004945
1198821199022
= 0004956
1198821199021
= 00003924
1198821199022
= 00069565
1198821199021
= 00003982
1198821199022
= 00045412
1198821199021
= 00002116
1198821199022
= 0006783
Wireless sensor usagerate 955 819 966 883
Sensor networkthroughput 436000 474300 453954 423561
Tasks loss rate 270677 0099 377 0098
Simulation software configuration communication taskstake the high-priority traffic and low-priority communica-tions task two categories Design the taskrsquos scheduling func-tion and assure 119862
1is approximately 400 operations and 119862
2is
about 4000 operationsThe program triggers communicationaccording to the different experimental parameters 120582 and119898 to test the influence on wireless sensor performanceThe experiment of the results compares with calculationresults of the method based on queuing theory to verifythe creditability of the method The statistics are shown inTable 3
When the sensor overloaded the sensor network handlesthe task for a long time and the state machine processing hasno support to the sensor network The actual speed of sensorprocessing 120583
119904119903is far less than 120583
119904 When the wireless sensor
network needed specific requirements 119905 of the loss rate andthe sensor throughput it can take the speed of the schedulingto the requirements
For formula (7) it can understand the relationshipbetween the loss rate and the capacity of scheduling It can
easily choose the right sensor in the network which willgreatly improve the quality of service
73 The Methods of Analysis The previous method of finiteautomata has discussed the regular expression matching sys-tem security in WSN and the evaluation of the performanceis ignored to research The matching method in some extentcan maintain the precision and accuracy in some systems itcan be used in a specific environment the performance of theevaluation in the wireless sensor network (WSN) that we hadresearched is in the universal environment it is necessary toconsider the problem of the restrictions such as the capacityof the buffer the length of the queue in the processing timethe performance of the calculation that needs enough bufferfor the task processing and the work conditions In ourresearch the approach which took the matching methodand the evaluating performance together is a new topic Themethod ensures maintaining the system security reducingthe loss rate of the communication task and improving theaccuracy of the scheduleThe universal approach can be used
8 The Scientific World Journal
in lots of environments in the wireless sensor network theapproach has a good excellent performance
8 Conclusions
This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth
The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model
Conflict of Interests
The authors declare that there is no conflict of interestsregarding the publication of this paper
Acknowledgments
This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)
References
[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014
[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002
[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002
[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003
[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011
[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of
the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999
[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011
[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008
[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005
[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011
[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014
[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013
[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012
[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006
[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012
[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008
[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006
[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006
[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007
[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001
[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000
[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational
The Scientific World Journal 9
approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009
[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011
[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009
[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010
Submit your manuscripts athttpwwwhindawicom
Computer Games Technology
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Distributed Sensor Networks
International Journal of
Advances in
FuzzySystems
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014
International Journal of
ReconfigurableComputing
Hindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Applied Computational Intelligence and Soft Computing
thinspAdvancesthinspinthinsp
Artificial Intelligence
HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014
Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Electrical and Computer Engineering
Journal of
Journal of
Computer Networks and Communications
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporation
httpwwwhindawicom Volume 2014
Advances in
Multimedia
International Journal of
Biomedical Imaging
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
ArtificialNeural Systems
Advances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
RoboticsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Computational Intelligence and Neuroscience
Industrial EngineeringJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Human-ComputerInteraction
Advances in
Computer EngineeringAdvances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World Journal 7
Table 2 Experimental data
Parameters
Results L7-Filter Snort1205781= 024
1205742= 077
1205951= 06
1205782= 026
1205742= 0831205952= 5
1205783= 036
1205743= 098
1205953= 10
1205781= 024
1205742= 077
1205951= 06
1205782= 026
1205742= 0831205952= 5
1205783= 036
1205743= 098
1205953= 10
Print size 015MB 031MB 012MB 025MB 039MB 024MBGroup number 14 17 11 14 15 12Average similarity 083 098 095 089 089 097Package size 1024 B 2048 B 4096 B 1024 B 2048 B 4096 BNumber of suspiciouspackage 253 83 122 41 114 48
Efficiency 8973 7317 765 831 7794 8535
Table 3 Experimental data statistics
Parameters
Indicator Queuing theory model calculation results NS2 simulation results1205821= 180 120582
2= 270
1205831= 1205832= 700
119898 = 100
1205821= 150 120582
2= 400
1205831= 1205832= 700
119898 = 35
1205821= 180
1205822= 400
119898 = 100
1205821= 150
1205822= 400
119898 = 35
Queue length 120 40 112 38
Average sojourn time(s) 1198821199041= 00019230
1198821199042= 0005385
1198821199041= 00018182
1198821199042= 0008485
1198821199041= 00018240
1198821199042= 0005062
1198821199041= 00016401
1198821199042= 000849
Average waiting time(s) 1198821199021
= 00004945
1198821199022
= 0004956
1198821199021
= 00003924
1198821199022
= 00069565
1198821199021
= 00003982
1198821199022
= 00045412
1198821199021
= 00002116
1198821199022
= 0006783
Wireless sensor usagerate 955 819 966 883
Sensor networkthroughput 436000 474300 453954 423561
Tasks loss rate 270677 0099 377 0098
Simulation software configuration communication taskstake the high-priority traffic and low-priority communica-tions task two categories Design the taskrsquos scheduling func-tion and assure 119862
1is approximately 400 operations and 119862
2is
about 4000 operationsThe program triggers communicationaccording to the different experimental parameters 120582 and119898 to test the influence on wireless sensor performanceThe experiment of the results compares with calculationresults of the method based on queuing theory to verifythe creditability of the method The statistics are shown inTable 3
When the sensor overloaded the sensor network handlesthe task for a long time and the state machine processing hasno support to the sensor network The actual speed of sensorprocessing 120583
119904119903is far less than 120583
119904 When the wireless sensor
network needed specific requirements 119905 of the loss rate andthe sensor throughput it can take the speed of the schedulingto the requirements
For formula (7) it can understand the relationshipbetween the loss rate and the capacity of scheduling It can
easily choose the right sensor in the network which willgreatly improve the quality of service
73 The Methods of Analysis The previous method of finiteautomata has discussed the regular expression matching sys-tem security in WSN and the evaluation of the performanceis ignored to research The matching method in some extentcan maintain the precision and accuracy in some systems itcan be used in a specific environment the performance of theevaluation in the wireless sensor network (WSN) that we hadresearched is in the universal environment it is necessary toconsider the problem of the restrictions such as the capacityof the buffer the length of the queue in the processing timethe performance of the calculation that needs enough bufferfor the task processing and the work conditions In ourresearch the approach which took the matching methodand the evaluating performance together is a new topic Themethod ensures maintaining the system security reducingthe loss rate of the communication task and improving theaccuracy of the scheduleThe universal approach can be used
8 The Scientific World Journal
in lots of environments in the wireless sensor network theapproach has a good excellent performance
8 Conclusions
This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth
The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model
Conflict of Interests
The authors declare that there is no conflict of interestsregarding the publication of this paper
Acknowledgments
This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)
References
[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014
[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002
[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002
[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003
[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011
[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of
the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999
[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011
[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008
[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005
[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011
[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014
[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013
[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012
[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006
[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012
[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008
[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006
[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006
[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007
[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001
[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000
[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational
The Scientific World Journal 9
approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009
[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011
[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009
[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010
Submit your manuscripts athttpwwwhindawicom
Computer Games Technology
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Distributed Sensor Networks
International Journal of
Advances in
FuzzySystems
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014
International Journal of
ReconfigurableComputing
Hindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Applied Computational Intelligence and Soft Computing
thinspAdvancesthinspinthinsp
Artificial Intelligence
HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014
Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Electrical and Computer Engineering
Journal of
Journal of
Computer Networks and Communications
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporation
httpwwwhindawicom Volume 2014
Advances in
Multimedia
International Journal of
Biomedical Imaging
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
ArtificialNeural Systems
Advances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
RoboticsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Computational Intelligence and Neuroscience
Industrial EngineeringJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Human-ComputerInteraction
Advances in
Computer EngineeringAdvances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
8 The Scientific World Journal
in lots of environments in the wireless sensor network theapproach has a good excellent performance
8 Conclusions
This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth
The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model
Conflict of Interests
The authors declare that there is no conflict of interestsregarding the publication of this paper
Acknowledgments
This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)
References
[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014
[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002
[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002
[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003
[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011
[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of
the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999
[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011
[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008
[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005
[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011
[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014
[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013
[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012
[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006
[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012
[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008
[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006
[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006
[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007
[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001
[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000
[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational
The Scientific World Journal 9
approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009
[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011
[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009
[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010
Submit your manuscripts athttpwwwhindawicom
Computer Games Technology
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Distributed Sensor Networks
International Journal of
Advances in
FuzzySystems
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014
International Journal of
ReconfigurableComputing
Hindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Applied Computational Intelligence and Soft Computing
thinspAdvancesthinspinthinsp
Artificial Intelligence
HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014
Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Electrical and Computer Engineering
Journal of
Journal of
Computer Networks and Communications
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporation
httpwwwhindawicom Volume 2014
Advances in
Multimedia
International Journal of
Biomedical Imaging
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
ArtificialNeural Systems
Advances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
RoboticsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Computational Intelligence and Neuroscience
Industrial EngineeringJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Human-ComputerInteraction
Advances in
Computer EngineeringAdvances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World Journal 9
approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009
[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011
[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009
[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010
Submit your manuscripts athttpwwwhindawicom
Computer Games Technology
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Distributed Sensor Networks
International Journal of
Advances in
FuzzySystems
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014
International Journal of
ReconfigurableComputing
Hindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Applied Computational Intelligence and Soft Computing
thinspAdvancesthinspinthinsp
Artificial Intelligence
HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014
Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Electrical and Computer Engineering
Journal of
Journal of
Computer Networks and Communications
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporation
httpwwwhindawicom Volume 2014
Advances in
Multimedia
International Journal of
Biomedical Imaging
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
ArtificialNeural Systems
Advances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
RoboticsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Computational Intelligence and Neuroscience
Industrial EngineeringJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Human-ComputerInteraction
Advances in
Computer EngineeringAdvances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Submit your manuscripts athttpwwwhindawicom
Computer Games Technology
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Distributed Sensor Networks
International Journal of
Advances in
FuzzySystems
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014
International Journal of
ReconfigurableComputing
Hindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Applied Computational Intelligence and Soft Computing
thinspAdvancesthinspinthinsp
Artificial Intelligence
HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014
Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Electrical and Computer Engineering
Journal of
Journal of
Computer Networks and Communications
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporation
httpwwwhindawicom Volume 2014
Advances in
Multimedia
International Journal of
Biomedical Imaging
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
ArtificialNeural Systems
Advances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
RoboticsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Computational Intelligence and Neuroscience
Industrial EngineeringJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Human-ComputerInteraction
Advances in
Computer EngineeringAdvances in
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014