research article based on regular expression...

10
Research Article Based on Regular Expression Matching of Evaluation of the Task Performance in WSN: A Queue Theory Approach Jie Wang, Kai Cui, Kuanjiu Zhou, and Yanshuo Yu School of Soſtware Technology, Dalian University of Technology, Dalian 116620, China Correspondence should be addressed to Kai Cui; cuikai [email protected] Received 4 July 2014; Accepted 16 August 2014; Published 23 October 2014 Academic Editor: Fei Yu Copyright © 2014 Jie Wang et al. is is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. Due to the limited resources of wireless sensor network, low efficiency of real-time communication scheduling, poor safety defects, and so forth, a queuing performance evaluation approach based on regular expression match is proposed, which is a method that consists of matching preprocessing phase, validation phase, and queuing model of performance evaluation phase. Firstly, the subset of related sequence is generated in preprocessing phase, guiding the validation phase distributed matching. Secondly, in the validation phase, the subset of features clustering, the compressed matching table is more convenient for distributed parallel matching. Finally, based on the queuing model, the sensor networks of task scheduling dynamic performance are evaluated. Experiments show that our approach ensures accurate matching and computational efficiency of more than 70%; it not only effectively detects data packets and access control, but also uses queuing method to determine the parameters of task scheduling in wireless sensor networks. e method for medium scale or large scale distributed wireless node has a good applicability. 1. Introduction Most wireless sensor network (WSN) missions are to detect and environmental reporting events. Since wireless sensor networks usually work under severe environments, their per- formance is oſten difficult or impossible to assess accurately. erefore, how to evaluate the performance in the wireless sensor network for task communication is the research emphasis in recent years, which becomes one of the most attractive. Most current researches have focused on how to provide authentication, confidentiality, integrity, nonrepudiation, and access control ad hoc [1, 2]. Distributed authentication is a very common approach to solve ad hoc security issues [3, 4]. However, highly secure ad hoc approach in certain circumstances the lack of a common approach [5, 6]. Because regular expressions provide excellent communi- cation skills and flexibility, they have been widely used in a variety of network security applications, such as antivirus scanning, network intrusion detection and prevention sys- tems [7], firewalls, and traffic classification and monitoring [8]. Deterministic finite automata (DFA) and nondetermin- istic finite automata (NFA) are the typical application of regular expressions. But this requires a certain store or time- consuming cycle tolerable for resource-constrained wireless sensor condition is basically meeting the application require- ments. Performance evaluation based on the communication task queuing model theory methods [9, 10], in recent years, published several class methods. However, previous methods suffer from the following disadvantages. In typical queuing model, customer arrival and the service processing are independent. However, they are relative to the sensor communication scheduling tasks. Sensors cannot receive communication and run the state machine at the same time. Usually the sensor is constant communication the occupied and communication task pro- cessing footprint. e arrival of the communication task has different priorities. e high-priority tasks can preempt the low-priority tasks, and the low-level tasks continue to run aſter the high-priority tasks processing is complete. Time constraints: the traditional system analysis oſten considered the average time while the task’s communication between wireless sensors needs to consider the maximum time aſter which the time state machine will transmit to another state. e method of finite automata has researched in the regular expression matching system security for the wireless Hindawi Publishing Corporation e Scientific World Journal Volume 2014, Article ID 654974, 9 pages http://dx.doi.org/10.1155/2014/654974

Upload: others

Post on 22-Jan-2020

63 views

Category:

Documents


0 download

TRANSCRIPT

Research ArticleBased on Regular Expression Matching of Evaluation ofthe Task Performance in WSN A Queue Theory Approach

Jie Wang Kai Cui Kuanjiu Zhou and Yanshuo Yu

School of Software Technology Dalian University of Technology Dalian 116620 China

Correspondence should be addressed to Kai Cui cuikai 006163com

Received 4 July 2014 Accepted 16 August 2014 Published 23 October 2014

Academic Editor Fei Yu

Copyright copy 2014 Jie Wang et alThis is an open access article distributed under the Creative Commons Attribution License whichpermits unrestricted use distribution and reproduction in any medium provided the original work is properly cited

Due to the limited resources of wireless sensor network low efficiency of real-time communication scheduling poor safety defectsand so forth a queuing performance evaluation approach based on regular expression match is proposed which is a methodthat consists of matching preprocessing phase validation phase and queuing model of performance evaluation phase Firstly thesubset of related sequence is generated in preprocessing phase guiding the validation phase distributed matching Secondly inthe validation phase the subset of features clustering the compressed matching table is more convenient for distributed parallelmatching Finally based on the queuing model the sensor networks of task scheduling dynamic performance are evaluatedExperiments show that our approach ensures accurate matching and computational efficiency of more than 70 it not onlyeffectively detects data packets and access control but also uses queuing method to determine the parameters of task scheduling inwireless sensor networks The method for medium scale or large scale distributed wireless node has a good applicability

1 Introduction

Most wireless sensor network (WSN) missions are to detectand environmental reporting events Since wireless sensornetworks usually work under severe environments their per-formance is often difficult or impossible to assess accuratelyTherefore how to evaluate the performance in the wirelesssensor network for task communication is the researchemphasis in recent years which becomes one of the mostattractive

Most current researches have focused on how to provideauthentication confidentiality integrity nonrepudiation andaccess control ad hoc [1 2] Distributed authentication isa very common approach to solve ad hoc security issues[3 4] However highly secure ad hoc approach in certaincircumstances the lack of a common approach [5 6]

Because regular expressions provide excellent communi-cation skills and flexibility they have been widely used ina variety of network security applications such as antivirusscanning network intrusion detection and prevention sys-tems [7] firewalls and traffic classification and monitoring[8] Deterministic finite automata (DFA) and nondetermin-istic finite automata (NFA) are the typical application of

regular expressions But this requires a certain store or time-consuming cycle tolerable for resource-constrained wirelesssensor condition is basically meeting the application require-ments Performance evaluation based on the communicationtask queuing model theory methods [9 10] in recent yearspublished several class methods

However previous methods suffer from the followingdisadvantages In typical queuing model customer arrivaland the service processing are independent However theyare relative to the sensor communication scheduling tasksSensors cannot receive communication and run the statemachine at the same time Usually the sensor is constantcommunication the occupied and communication task pro-cessing footprint The arrival of the communication task hasdifferent priorities The high-priority tasks can preempt thelow-priority tasks and the low-level tasks continue to runafter the high-priority tasks processing is complete Timeconstraints the traditional system analysis often consideredthe average time while the taskrsquos communication betweenwireless sensors needs to consider the maximum time afterwhich the time state machine will transmit to another state

The method of finite automata has researched in theregular expression matching system security for the wireless

Hindawi Publishing Corporatione Scientific World JournalVolume 2014 Article ID 654974 9 pageshttpdxdoiorg1011552014654974

2 The Scientific World Journal

sensor networks and matching performance is ignored tofurther discussion [11] similarly the evaluation of the per-formance based on the queue model in the wireless sensornetwork (WSN) has been discussed but the system securitymatching method not to do more research [12] therefore wecombined with the previous work in this paper the securitymatching method of finite automata and the performance ofthe queuing model was discussed in WSN

The rest of the paper is organized as follows Section 2reviews regular expression two-stage matching strategySection 3 explains the regular expressionmatching approachIn Section 4 model of task scheduling based on queuingtheory is proposed In Section 5 the priority queue with twoclasses of tasks is proposed We describe the performance ofthe wireless sensor communication tasks based on queuingtheory in Section 6 In Section 7 simulations are conductedfor illustrating the performance of our scheme Finally weconclude this paper in Section 8

2 Regular Expression Two-StageMatching Strategy [11]

Recent research has paid much attention to reduction ofthe huge memory usage for DFA-based regular expressionmatching as DFA is the preferred representation of regularexpression matching As a matter of fact they can onlyachieve memory reduction for specific regular expressionor signature sets of simple High-speed regular expressionmatching for real-world signature sets that contain thousandsof complex regular expressions can be hardly achieved Inmodern networking devices TCAMs (off-the-shelf chips)have been widely deployed However even if techniques suchas D2FA [13 14] are employed tables of DFA andNFA are toobig to be stored in TCAMs In 2012 the RegexFilter (a high-speed and memory efficient technique) was presented by Liuet al [15] Regular expression matching was been sped up byquickly searching these regular expressions that may matcheach arriving item as little as possible However this methodonly cares about the profiteering stage and left the verifyingstage without any optimization

21 Profiteering Stage For instance there is a regular expres-sion set called 119877 another set 119877

1015840 is constructed so thatany unmatched item of 119877

1015840 is also an unmatched item of119877 An item that does not match any regular expression inthe set [15] is unmatched item of a regular expression setGiven an item 119894 it will match against 1198771015840 to get set 119874(1198771015840 119894)firstly If 119874(1198771015840 119894) is empty it does not obviously match anymember in 119877 and therefore this item can be skipped safelyotherwise matching it against 119879 (119877119874(119877

1015840 119894)) will continue

where 119874(119877 119894) sube 119879 (119877 119874(1198771015840 119894)) sube 119877 Figure 1 shows the

relationship between match items and print (1198771015840) Becausemost items are unmatched and the match cost of 119877

0is much

less than that of 119877 the overall throughput of this approachcan be much higher than directly matching against 119877

22 Verifying Stage In the verifying stage how to buildcorrelation from profiteering print and reduce the memory

All items

Match items

R

Print R998400

Figure 1 Relationship between profiteering stage set and matchitems

cost of DFA tables is the main point that needs to be handledA DFA is presented by a 5-tuple (119876sum 120575 119902

0 119860) where 119876 is a

set of states 119875 is an alphabet sumtimes119876 rarr 119876 is the transitionfunction 119876

0is the start state and 119860 sube 119876 is a set of accepting

states The major part we should deal with is the DFA-basedalgorithms with the large amount of memory requirement tostore the transition table Software-based [16ndash18] and FPGA-based [19 20] regular expressionmatching algorithms are tra-ditional approaches with many shortcomings TCAM-basedsolutions have the advantages of easy encoding and highparallelism [13] Three novel techniques transition sharingtable consolidation and variable striding were proposed byLiu et al to reduceTCAMspace and improvematching speed

3 Regular Expression Matching Approach

The selecting process of regular expression ldquo119886[119887119888]119889 [119887119888]rdquowith five atoms is shown in Figure 2 The parameter 120573 = 256

is the boundary we define and the expression size of everyprint should be less than 120573 The selecting stage begins fromthe first atom The curr pointer keeps moving to the nextatom if ES(119903) value of the regular expression print between thebegin pointer and end pointer until the curr pointer arrivesat the fourth atom ldquosdotrdquo ES(119886[119887119888]119889 ) = 1 lowast 2 lowast 1 lowast 256 =

512 gt 120573 Condition ES(119903) lt 120573 does not hold and print119886[119887119888]119889 is selected Then a directed line from 119903

119894to 119875119894to mark

the correlation relationship is constructed Then in step 2it is included in the already selected print ldquo119886[119887119888]119889rdquo although[119887119888]119889 satisfies the condition According to section A 119886[119887119888]119889has higher matching probability (MP) than [119887119888]119889 thus [119887119888]119889is not selected The same criteria are processed in steps 3 4and 5 to select print

After selecting the print a relationship of this graph calledcorrelation sequence is generated as a directed graph from119903[1119899]

to 119901[1119898]

Every package will be transmitted across certain nodes

1198731 1198732 119873

119899according to ad hoc wireless protocol These

nodes will be grouped into two groups one group forprofiteering stage and the other group for verifying stageExtra package fields are adopted to make each node workcollaboratively and communicate with the other

The Scientific World Journal 3

1 2 2

Begin

Begin

Begin

Begin

Begin

Curr

Curr

Curr

Curr

Curr

a[bc]d is selected

2 2

[bc]d is not selected

[bc] is selected

a [bc] [bc]d

1

2

a[ab]d

[bc]

a [bc] [bc]d

a [bc] [bc]d

a [bc] [bc]d

a [bc] [bc]d

512

512

512256

512256

middot is not selected

middot

middot

middot

middot

middot

r1

ri

rn

ri = a[bc]d middot [bc]

d middot is selected

d middot

p1

p1

ps

pk

pm

Figure 2 Process of generating print 119901119894from 119903

119894

5

6

2

4

1

3

7

Package

Prefilteringand getp[1m]

Calculate

F(gi p[1m])

P1P2

Pn

Calculate

F(gi p[1m])

p1p2

pn

Calculate

F(gi p[1m])

p1p2

pn

gi

gi

gi

C1

C2

C3

C4

Figure 3 Matching process of ad hoc packages

The package matching process is demonstrated inFigure 3 Taking the limited computing power of each wire-less node into consideration the calculation of 119865(119892

119894 119901[1119898]

)

is simplified to be addition only At first the feature vector 119901119894

needs to be stored so that the sum of 119901119894can be calculated to

get119865(119892119894 119901[1119898]

)Theprofiteered correlation sequence119901[1sdotsdotsdot119898]

will be generated in node 2 after profiteering stage in node 1Then if 119901

[1sdotsdotsdot119898]is not empty the 119865(119892

119894 119901[1119898]

) is calculatedin node 2 by adding the feature vector 119901

119894 Verifying process

will continue in node 2 using the group 119892119894in its memory

when 119865(119892119894 119901[1119898]

) is larger than 120595 Otherwise the packagewill be transmitted to the next hop and 119892

119895will be matched

continually

4 Queue Model Description [12]

The pattern of communication between wireless sensorscan be divided into two modes the synchronous and theasynchronousmodes In synchronousmode when a pluralityof communication tasks are triggered the tasks schedulingwill be suspended At this moment the levels of querypriority and processes priority are executed in sequenceThismode has a higher efficiency when the transmissions are notfrequent However this will lead to an unacceptable high lossrate of the communication tasks when the transmissions arefrequently triggered In asynchronous mode when the taskto transmit the scheduling will not immediately to processhowever the priority communication tasks are added to thequeue in sequence then the wireless sensor through statemachine to fetch the head of the communication task in

4 The Scientific World Journal

IE IE IEINI0 INI1 INIn

d (x gt 2 y lt 3)

e (x gt

5 ygt 4)

y =

0

a (x lt 2) y = 0

f (x gt 2 y gt 4)

b (xgt2)

ex=

=0y

0

middot middot middot

c (x = 2) y = 0 S0

S1

S2

S3 S4 S5

Figure 4Queuing theorymodel of thewireless sensor networkwith119899 communication taskrsquos scheduling

the queue and executes the task scheduling function Thismodel greatly reduces the tasksrsquo loss thus determining thewireless sensor network (WSN) which is formed in one ofthe biggest communication task captains that are of greathelp to guide sensor network design Figure 4 shows 119899-taskcommunication scheduling based on the queuing theorymodel in the wireless sensor network

Input process communication tasks are divided into 119873

levels The first level has the highest priority the secondpriority has secondary priority and so forth The119873 level hasthe lowest priority Assume that each communication taskinterval is the Poisson distribution or negative exponentialdistribution The average time of the interval of the 119894th levelcommunication task is 120582

119894

Queuing rules the task responses as soon as the com-munication task arrival by the background task executioncall service when the task is not scheduling executed in thesystem The high-priority communication tasks priority isexecuted in sequence until the end of all high-priority tasksin the queue When the low-priority tasks are executing thehigh-priority task takes over the low-priority task and thelow-priority task will return to the queue the same prioritycommunication task followed by FCFS rues

Service process wireless sensor network uses the statemachine to drive communication task process assumingthat each time of the communication task is exponentialdistribution and the average service of level 119894 communicationtask rate is 120583

119894

The WSN communication tasks queue performanceparameters [21] (a) absolute throughput 119860 is the average

00 01 02 03

10

20

30

11

21

31

12

22

32

13

23

33

40 41 42 43

i

j

u21205822

1205822 1205822

1205822

1205822

12058221205822

1205822

1205822

u21205822

u21205822

12058311205821

1205831 12058311205821

12058311205821

12058311205821 12058311205821

12058311205821

1205821 1205821

1205821

1205821

1205831 1205821 1205821

middot middot middot

Figure 5 System state spaces and the transfer process

time of task service in the unit time (b) relative throughput119876 is the ratio of all the severed tasks and all request tasksin the unit time (c) the queue length of the average value119871119904is all communication tasks in the WSN (d) the queue

of average length 119871119902is the average number of the waiting

tasks in the queue (e) the average sojourn times 119882119904are the

average of the taskwaiting for service time119882119902and the average

service time 120591 (then 119882119904= 119882119902+ 120591) (f) busy period 119879

119887is the

random parameter (g) system loss rates 119875loss are the overflowprobability

5 Priority Queue with Two Classes of Tasks

Assume the queuing system is the preemptive priority The119894th task arrival is Poisson distribution with parameter 120582

119894

the service time is exponentially distributed with parameter120583(119894 = 1 2 ) Level 1th priority communication task ismore priority than level 2th priority task The system stateis 119864 = (119894 119895) 0 ⩽ 119894 0 ⩽ 119895 119894(119895) represents the 1(2) level ofthe communication tasksThe system state space distribution119875(119894 119895) = 119875

119894119895 0 ⩽ 119894 0 ⩽ 119895 The system transition process is

depicted in Figure 5

6 Tasks PerformanceIndicators in Sensor Network

The priority tasks processing is as follows when the 1stlevel task with parameters 120582

1and the 2nd level task with

parameters 1205822arrive service times of two level tasks are the

1205831and 120583

2 the taskrsquos priority is reduced in sequence and

they share the waiting queue The recursive calculation ofprobability matrix 119875

119894119895 0 ⩽ 119895 ⩽ 119873 needs a large amount

of calculation therefore Matlab software is the necessarysoftwareTheMM1 preemptive priority queuemodel is usedin the experiments The arrival of the 119894th level task process as

The Scientific World Journal 5

a Poisson distribution with the parameter 120582119894and service time

as a negative exponential distribution with the parameter120583119894(119894 = 1 2) The 1st level tasks are more priority than the

2nd level communication tasks Assume the parameters are1205821= 170 120582

2= 300 120583

1= 500 and 120583

2= 700

(1) Steady-State Queue Length Figure 6 shows the probabilityand the queue length as the 120583

2increasing The vertical axis

is the probability and the horizontal axis is the queue lengthIn the probability matrix 119875 = 0 the maximum queue lengthcan be obtained in the system and assures that taskrsquos buffer isenough to calculate the taskrsquos loss

In the simulation 119871119904= 40 which is the maximum queue

length when 119875 = 0 the arrivals of the taskrsquos probability are0 this means the possibility of task arrival does not exist andthe length does not grow Then when 119875 = 0 the length canbe regarded as the largest queue length(2) Average Sojourn Time Assume that every level of taskarrival is Poisson distribution The 119894th level tasks are withthe parameter 120582

119894 the service time is the negative exponential

distribution and the average service time is 1120583 The averagesojourn times 119882

1199041and 119882

1199042are calculated in the following

formulas

1199081199041=

1

120583 minus 1205821

1199081199021

= 1199081199041minus

1

120583=

1205821

120583 (120583 minus 1205821)

(1)

1199081199041= (1 +

1205821

1205822

) times (1

120583 minus 1205821minus 1205822

) minus1205821

1205822

times1

120583 minus 1205821

1199081199022

= 1199081199042minus

1

120583

(2)

(3) AverageWaiting Time [22]The sameway the queue of theaverage waiting times 119882

1199021and 119882

1199022is calculated as formula

(1)(4) Wireless Sensor Usage Rate [23] 119875 is the probability of thewireless sensor being idle then 120588 = 1 minus 119875 where 120588 is theoccupancy probability of communication task [24 25] Thegreater 120588 is the greater the occupancy probability is 120588 is theservice capacity or the load capacity To consider the prac-ticality of the model the queue length is not unlimited Todetermine the performance indicators we take the queuingmodel of MM1N and set the buffer capacity which is119898(5) Taskrsquos Throughput The communication taskrsquos time 119879 isdivide into three parts they are the taskrsquos processing time 119879

119894

the state machine processing time 119879119904 and the wireless sensor

idle time119879119903 119879119894+119879119904asymp 119879The taskrsquos processing is more priority

than the state machine processing Assume the tasks servicestrength is 120588

119894 then the tasks processing time is 119879

119894= 120588119894119879 and

the state machine processing time is 119879119904= (1 minus 120588

119894)119879

The processing of the finite automata is the queuingmodel ofMM1N the input processing with the parameter120582119904and the service time with the parameter 120583

119904are the

negative exponential distribution length of the buffer is 119899Theprocessing speed of the communication task is faster than

Queue length

Prob

abili

ty

0

005

01

015

02

5 10 15 20 25 30 35

1205821 = 190 1205822 = 230 1205831 = 450 1205832 = 500

1205821 = 220 1205822 = 230 1205831 = 450 1205832 = 500

1205821 = 170 1205822 = 300 1205831 = 500 1205832 = 500

1205821 = 100 1205822 = 230 1205831 = 450 1205832 = 500

Figure 6 Probability and queue length graph

the processing speed of the state machine Thus the actualprocessing capability of the state machine is 120583

119904119903= (1 minus 120588

119894)120583119904

and the buffer length is119898 then the loss rate is

119875lost =1 minus 120588119904119903

1 minus 120588119898+1119904119903

120588119898

119904119903 (3)

In particular 120588119904119903= 120582119904120583119904119903

As to formula (1) the calculation which the state machinethroughput computes is the following formula

1205820= 120582119904(1 minus

1 minus 120588119904119903

1 minus 120588119898+1119904119903

120588119898

119904119903) (4)

When the sensor network is severely overloading the120582119904≫ 120583119904119903 and the 120588

119904119903≫ 1 As to formula (2) formula (5) is

calculated due to formula (5) and the speed of the parameter120582119894affects the performance of the task processing the greater

120582119894is the lower the performance of the task processing is

When the communication tasks processing rate 120583119894and the

state machine processing rate 120583119903remain unchanged the

performance curve is a straight line in which the slope isminus120583119903120583119894 Consider

1205820asymp 120583119904119903= (1 minus 120588

119894) 120583119903= (1 minus

120582119894

120583119894

)120583119903 (5)

(6) Wireless Sensor Processing Capacity Assume the process-ing capacity is of119873mips the quantity of the tasks which needto be executed in the taskrsquos processing is 119862

1and the quantity

of the tasks which need to be executed in the state machineis1198622 then the taskrsquos processing capacity computes as formula

(3) formula (6) is as follows

120588119904119903=

120582119904

120583119904119903

=120582119894

(1 minus 120588119894) 120583119904

=120582119894

(1 minus (120582119894120583119894)) 120583119904

=120582119894

(1 minus (120582119894 (119873119862

1))) (119873119862

2)=

1205821198941198622

119873 minus 1205821198941198621

(6)

6 The Scientific World Journal

Table 1 Experimental parameters setting

Parameter L7-Filter SnortNum of RegExp 161 166Num of DFA states 1432 1257120573 (expression size) 256 256120595 (relevance frequency) [023 034] [023 034]120578 (match probability) [075 099] [075 099]120574 (similarity) [05 10] [05 10]

Take formula (6) into formula (3) the loss rate 119876 is

119876 = 119875lost =1 minus (120582

1198941198622 (119873 minus 120582

1198941198621))

1 minus [1205821198941198622 (119873 minus 120582

1198941198621)]119898+1

times(1205821198941198622)119898

[119873 minus 1205821198941198621]119898

=(1205821198941198622)119898

sum119898

119894=0[119873 minus 120582

1198941198621]119894

(1205821198941198622)119898minus119894

(7)

Formula (7) is the relationship between the loss rate andthe processing capacity It helps to determine the require-ments of the taskrsquos processing

7 Experiment

71 Experiment Set We evaluated our matching approachby regular expression sets extracted from two real-worldsystems named L7-Filter and Snort L7-Filter is famous opensource application layer traffic classier for LinuxThe payloadcontent of a flow and identified its application level protocolare reassembled through regular expression matching Snortis a well-known open-source intrusion detection systemwhich can be configured to performprotocol analysis probesand content inspecting over online traffic by detecting avariety of worms Two sets are chosen as 119877 = 119903

1 1199032 119903

119899

to perform the experiments The experiment parameters ESMP are set as shown in Table 1Then the local optimal valuecan be obtained during our experiments

Print size denotes the memory occupation of prints afterthe profiteering stage Group number is the group number ofcorrelative regular expression according to the parameter 120574Average similarity is the average value of similarity in eachgroup (see (2)) Package size is the testing packages lengthOur simulation environment is based on NS-2 (NetworkSimulator version 2) We set the number of nodes from 20 to100 Number of suspicious package is the number of packagethat needs to be verified after the profiteering stage Lastly wecalculate our experiment efficiency by their average executingcost Efficiency = (Num of suspicious packageTotal packageNumber) times (119865(119892

119894)Group Number)

Table 2 demonstrates that we can get a good efficiencypromotion from 7317 to 8973 A regular matchingcomparison was performed with our strategy and normalapproach The average hop and average 119865(119866

119894) variation

tendency and the number of nodes are shown in Figure 7L7-Filter and Snort were tested separately 119910-axis is hops and119909-axis indicates the nodes number From the results figure

Average hops on L7

010

50

40

30

20

10

20 30 40 50 60 70 80 90

Average hops on Snort

Nodes

10 20 30 40 50 60 70 80 90Nodes

Hops L7Hops L7 Gi

Hop

s

0

50

40

30

20

10

Hop

s

Hops SnortHops Snort Gi

Figure 7 Results of node average hops in NS-2

a significant difference can be observed when nodes aremorethan 30 the hops number of using 119866

119894decreases sharply

Figure 7 demonstrates that the matching approach cantest and verify the packages efficiently when the number ofwireless nodes is more than 30 which indicates that ourapproach can be well adapted to medium or large scaledistributed wireless sensor network On the other hand thereis no major difference in average hops when the system ishandling a small group of wireless nodes Comparing withother end-to-end strategies [9] our approach provides awell scalable way to construct intrusion detection systemby integrating distributed wireless sensor nodes Based onappropriate parameters network attacks can bemonitored byour system in an effective way

72 Experiment of Queue Model The experiment comparestwo groups of the performance results which computed bythe queuing theory and got the results from the softwareNS2 The NS2 platform simulated the STM32W108 sensornetworking we found that it is affected with the followingparameters the average length of stay for communicationtasks the average queue waiting time of tasks the occupancyrate and the task throughput

The Scientific World Journal 7

Table 2 Experimental data

Parameters

Results L7-Filter Snort1205781= 024

1205742= 077

1205951= 06

1205782= 026

1205742= 0831205952= 5

1205783= 036

1205743= 098

1205953= 10

1205781= 024

1205742= 077

1205951= 06

1205782= 026

1205742= 0831205952= 5

1205783= 036

1205743= 098

1205953= 10

Print size 015MB 031MB 012MB 025MB 039MB 024MBGroup number 14 17 11 14 15 12Average similarity 083 098 095 089 089 097Package size 1024 B 2048 B 4096 B 1024 B 2048 B 4096 BNumber of suspiciouspackage 253 83 122 41 114 48

Efficiency 8973 7317 765 831 7794 8535

Table 3 Experimental data statistics

Parameters

Indicator Queuing theory model calculation results NS2 simulation results1205821= 180 120582

2= 270

1205831= 1205832= 700

119898 = 100

1205821= 150 120582

2= 400

1205831= 1205832= 700

119898 = 35

1205821= 180

1205822= 400

119898 = 100

1205821= 150

1205822= 400

119898 = 35

Queue length 120 40 112 38

Average sojourn time(s) 1198821199041= 00019230

1198821199042= 0005385

1198821199041= 00018182

1198821199042= 0008485

1198821199041= 00018240

1198821199042= 0005062

1198821199041= 00016401

1198821199042= 000849

Average waiting time(s) 1198821199021

= 00004945

1198821199022

= 0004956

1198821199021

= 00003924

1198821199022

= 00069565

1198821199021

= 00003982

1198821199022

= 00045412

1198821199021

= 00002116

1198821199022

= 0006783

Wireless sensor usagerate 955 819 966 883

Sensor networkthroughput 436000 474300 453954 423561

Tasks loss rate 270677 0099 377 0098

Simulation software configuration communication taskstake the high-priority traffic and low-priority communica-tions task two categories Design the taskrsquos scheduling func-tion and assure 119862

1is approximately 400 operations and 119862

2is

about 4000 operationsThe program triggers communicationaccording to the different experimental parameters 120582 and119898 to test the influence on wireless sensor performanceThe experiment of the results compares with calculationresults of the method based on queuing theory to verifythe creditability of the method The statistics are shown inTable 3

When the sensor overloaded the sensor network handlesthe task for a long time and the state machine processing hasno support to the sensor network The actual speed of sensorprocessing 120583

119904119903is far less than 120583

119904 When the wireless sensor

network needed specific requirements 119905 of the loss rate andthe sensor throughput it can take the speed of the schedulingto the requirements

For formula (7) it can understand the relationshipbetween the loss rate and the capacity of scheduling It can

easily choose the right sensor in the network which willgreatly improve the quality of service

73 The Methods of Analysis The previous method of finiteautomata has discussed the regular expression matching sys-tem security in WSN and the evaluation of the performanceis ignored to research The matching method in some extentcan maintain the precision and accuracy in some systems itcan be used in a specific environment the performance of theevaluation in the wireless sensor network (WSN) that we hadresearched is in the universal environment it is necessary toconsider the problem of the restrictions such as the capacityof the buffer the length of the queue in the processing timethe performance of the calculation that needs enough bufferfor the task processing and the work conditions In ourresearch the approach which took the matching methodand the evaluating performance together is a new topic Themethod ensures maintaining the system security reducingthe loss rate of the communication task and improving theaccuracy of the scheduleThe universal approach can be used

8 The Scientific World Journal

in lots of environments in the wireless sensor network theapproach has a good excellent performance

8 Conclusions

This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth

The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)

References

[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014

[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002

[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002

[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003

[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011

[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of

the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999

[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011

[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008

[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005

[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011

[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014

[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013

[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012

[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006

[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012

[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008

[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006

[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006

[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007

[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001

[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000

[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational

The Scientific World Journal 9

approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009

[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011

[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009

[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010

Submit your manuscripts athttpwwwhindawicom

Computer Games Technology

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Distributed Sensor Networks

International Journal of

Advances in

FuzzySystems

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014

International Journal of

ReconfigurableComputing

Hindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Applied Computational Intelligence and Soft Computing

thinspAdvancesthinspinthinsp

Artificial Intelligence

HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014

Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Electrical and Computer Engineering

Journal of

Journal of

Computer Networks and Communications

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporation

httpwwwhindawicom Volume 2014

Advances in

Multimedia

International Journal of

Biomedical Imaging

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

ArtificialNeural Systems

Advances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

RoboticsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Computational Intelligence and Neuroscience

Industrial EngineeringJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Human-ComputerInteraction

Advances in

Computer EngineeringAdvances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

2 The Scientific World Journal

sensor networks and matching performance is ignored tofurther discussion [11] similarly the evaluation of the per-formance based on the queue model in the wireless sensornetwork (WSN) has been discussed but the system securitymatching method not to do more research [12] therefore wecombined with the previous work in this paper the securitymatching method of finite automata and the performance ofthe queuing model was discussed in WSN

The rest of the paper is organized as follows Section 2reviews regular expression two-stage matching strategySection 3 explains the regular expressionmatching approachIn Section 4 model of task scheduling based on queuingtheory is proposed In Section 5 the priority queue with twoclasses of tasks is proposed We describe the performance ofthe wireless sensor communication tasks based on queuingtheory in Section 6 In Section 7 simulations are conductedfor illustrating the performance of our scheme Finally weconclude this paper in Section 8

2 Regular Expression Two-StageMatching Strategy [11]

Recent research has paid much attention to reduction ofthe huge memory usage for DFA-based regular expressionmatching as DFA is the preferred representation of regularexpression matching As a matter of fact they can onlyachieve memory reduction for specific regular expressionor signature sets of simple High-speed regular expressionmatching for real-world signature sets that contain thousandsof complex regular expressions can be hardly achieved Inmodern networking devices TCAMs (off-the-shelf chips)have been widely deployed However even if techniques suchas D2FA [13 14] are employed tables of DFA andNFA are toobig to be stored in TCAMs In 2012 the RegexFilter (a high-speed and memory efficient technique) was presented by Liuet al [15] Regular expression matching was been sped up byquickly searching these regular expressions that may matcheach arriving item as little as possible However this methodonly cares about the profiteering stage and left the verifyingstage without any optimization

21 Profiteering Stage For instance there is a regular expres-sion set called 119877 another set 119877

1015840 is constructed so thatany unmatched item of 119877

1015840 is also an unmatched item of119877 An item that does not match any regular expression inthe set [15] is unmatched item of a regular expression setGiven an item 119894 it will match against 1198771015840 to get set 119874(1198771015840 119894)firstly If 119874(1198771015840 119894) is empty it does not obviously match anymember in 119877 and therefore this item can be skipped safelyotherwise matching it against 119879 (119877119874(119877

1015840 119894)) will continue

where 119874(119877 119894) sube 119879 (119877 119874(1198771015840 119894)) sube 119877 Figure 1 shows the

relationship between match items and print (1198771015840) Becausemost items are unmatched and the match cost of 119877

0is much

less than that of 119877 the overall throughput of this approachcan be much higher than directly matching against 119877

22 Verifying Stage In the verifying stage how to buildcorrelation from profiteering print and reduce the memory

All items

Match items

R

Print R998400

Figure 1 Relationship between profiteering stage set and matchitems

cost of DFA tables is the main point that needs to be handledA DFA is presented by a 5-tuple (119876sum 120575 119902

0 119860) where 119876 is a

set of states 119875 is an alphabet sumtimes119876 rarr 119876 is the transitionfunction 119876

0is the start state and 119860 sube 119876 is a set of accepting

states The major part we should deal with is the DFA-basedalgorithms with the large amount of memory requirement tostore the transition table Software-based [16ndash18] and FPGA-based [19 20] regular expressionmatching algorithms are tra-ditional approaches with many shortcomings TCAM-basedsolutions have the advantages of easy encoding and highparallelism [13] Three novel techniques transition sharingtable consolidation and variable striding were proposed byLiu et al to reduceTCAMspace and improvematching speed

3 Regular Expression Matching Approach

The selecting process of regular expression ldquo119886[119887119888]119889 [119887119888]rdquowith five atoms is shown in Figure 2 The parameter 120573 = 256

is the boundary we define and the expression size of everyprint should be less than 120573 The selecting stage begins fromthe first atom The curr pointer keeps moving to the nextatom if ES(119903) value of the regular expression print between thebegin pointer and end pointer until the curr pointer arrivesat the fourth atom ldquosdotrdquo ES(119886[119887119888]119889 ) = 1 lowast 2 lowast 1 lowast 256 =

512 gt 120573 Condition ES(119903) lt 120573 does not hold and print119886[119887119888]119889 is selected Then a directed line from 119903

119894to 119875119894to mark

the correlation relationship is constructed Then in step 2it is included in the already selected print ldquo119886[119887119888]119889rdquo although[119887119888]119889 satisfies the condition According to section A 119886[119887119888]119889has higher matching probability (MP) than [119887119888]119889 thus [119887119888]119889is not selected The same criteria are processed in steps 3 4and 5 to select print

After selecting the print a relationship of this graph calledcorrelation sequence is generated as a directed graph from119903[1119899]

to 119901[1119898]

Every package will be transmitted across certain nodes

1198731 1198732 119873

119899according to ad hoc wireless protocol These

nodes will be grouped into two groups one group forprofiteering stage and the other group for verifying stageExtra package fields are adopted to make each node workcollaboratively and communicate with the other

The Scientific World Journal 3

1 2 2

Begin

Begin

Begin

Begin

Begin

Curr

Curr

Curr

Curr

Curr

a[bc]d is selected

2 2

[bc]d is not selected

[bc] is selected

a [bc] [bc]d

1

2

a[ab]d

[bc]

a [bc] [bc]d

a [bc] [bc]d

a [bc] [bc]d

a [bc] [bc]d

512

512

512256

512256

middot is not selected

middot

middot

middot

middot

middot

r1

ri

rn

ri = a[bc]d middot [bc]

d middot is selected

d middot

p1

p1

ps

pk

pm

Figure 2 Process of generating print 119901119894from 119903

119894

5

6

2

4

1

3

7

Package

Prefilteringand getp[1m]

Calculate

F(gi p[1m])

P1P2

Pn

Calculate

F(gi p[1m])

p1p2

pn

Calculate

F(gi p[1m])

p1p2

pn

gi

gi

gi

C1

C2

C3

C4

Figure 3 Matching process of ad hoc packages

The package matching process is demonstrated inFigure 3 Taking the limited computing power of each wire-less node into consideration the calculation of 119865(119892

119894 119901[1119898]

)

is simplified to be addition only At first the feature vector 119901119894

needs to be stored so that the sum of 119901119894can be calculated to

get119865(119892119894 119901[1119898]

)Theprofiteered correlation sequence119901[1sdotsdotsdot119898]

will be generated in node 2 after profiteering stage in node 1Then if 119901

[1sdotsdotsdot119898]is not empty the 119865(119892

119894 119901[1119898]

) is calculatedin node 2 by adding the feature vector 119901

119894 Verifying process

will continue in node 2 using the group 119892119894in its memory

when 119865(119892119894 119901[1119898]

) is larger than 120595 Otherwise the packagewill be transmitted to the next hop and 119892

119895will be matched

continually

4 Queue Model Description [12]

The pattern of communication between wireless sensorscan be divided into two modes the synchronous and theasynchronousmodes In synchronousmode when a pluralityof communication tasks are triggered the tasks schedulingwill be suspended At this moment the levels of querypriority and processes priority are executed in sequenceThismode has a higher efficiency when the transmissions are notfrequent However this will lead to an unacceptable high lossrate of the communication tasks when the transmissions arefrequently triggered In asynchronous mode when the taskto transmit the scheduling will not immediately to processhowever the priority communication tasks are added to thequeue in sequence then the wireless sensor through statemachine to fetch the head of the communication task in

4 The Scientific World Journal

IE IE IEINI0 INI1 INIn

d (x gt 2 y lt 3)

e (x gt

5 ygt 4)

y =

0

a (x lt 2) y = 0

f (x gt 2 y gt 4)

b (xgt2)

ex=

=0y

0

middot middot middot

c (x = 2) y = 0 S0

S1

S2

S3 S4 S5

Figure 4Queuing theorymodel of thewireless sensor networkwith119899 communication taskrsquos scheduling

the queue and executes the task scheduling function Thismodel greatly reduces the tasksrsquo loss thus determining thewireless sensor network (WSN) which is formed in one ofthe biggest communication task captains that are of greathelp to guide sensor network design Figure 4 shows 119899-taskcommunication scheduling based on the queuing theorymodel in the wireless sensor network

Input process communication tasks are divided into 119873

levels The first level has the highest priority the secondpriority has secondary priority and so forth The119873 level hasthe lowest priority Assume that each communication taskinterval is the Poisson distribution or negative exponentialdistribution The average time of the interval of the 119894th levelcommunication task is 120582

119894

Queuing rules the task responses as soon as the com-munication task arrival by the background task executioncall service when the task is not scheduling executed in thesystem The high-priority communication tasks priority isexecuted in sequence until the end of all high-priority tasksin the queue When the low-priority tasks are executing thehigh-priority task takes over the low-priority task and thelow-priority task will return to the queue the same prioritycommunication task followed by FCFS rues

Service process wireless sensor network uses the statemachine to drive communication task process assumingthat each time of the communication task is exponentialdistribution and the average service of level 119894 communicationtask rate is 120583

119894

The WSN communication tasks queue performanceparameters [21] (a) absolute throughput 119860 is the average

00 01 02 03

10

20

30

11

21

31

12

22

32

13

23

33

40 41 42 43

i

j

u21205822

1205822 1205822

1205822

1205822

12058221205822

1205822

1205822

u21205822

u21205822

12058311205821

1205831 12058311205821

12058311205821

12058311205821 12058311205821

12058311205821

1205821 1205821

1205821

1205821

1205831 1205821 1205821

middot middot middot

Figure 5 System state spaces and the transfer process

time of task service in the unit time (b) relative throughput119876 is the ratio of all the severed tasks and all request tasksin the unit time (c) the queue length of the average value119871119904is all communication tasks in the WSN (d) the queue

of average length 119871119902is the average number of the waiting

tasks in the queue (e) the average sojourn times 119882119904are the

average of the taskwaiting for service time119882119902and the average

service time 120591 (then 119882119904= 119882119902+ 120591) (f) busy period 119879

119887is the

random parameter (g) system loss rates 119875loss are the overflowprobability

5 Priority Queue with Two Classes of Tasks

Assume the queuing system is the preemptive priority The119894th task arrival is Poisson distribution with parameter 120582

119894

the service time is exponentially distributed with parameter120583(119894 = 1 2 ) Level 1th priority communication task ismore priority than level 2th priority task The system stateis 119864 = (119894 119895) 0 ⩽ 119894 0 ⩽ 119895 119894(119895) represents the 1(2) level ofthe communication tasksThe system state space distribution119875(119894 119895) = 119875

119894119895 0 ⩽ 119894 0 ⩽ 119895 The system transition process is

depicted in Figure 5

6 Tasks PerformanceIndicators in Sensor Network

The priority tasks processing is as follows when the 1stlevel task with parameters 120582

1and the 2nd level task with

parameters 1205822arrive service times of two level tasks are the

1205831and 120583

2 the taskrsquos priority is reduced in sequence and

they share the waiting queue The recursive calculation ofprobability matrix 119875

119894119895 0 ⩽ 119895 ⩽ 119873 needs a large amount

of calculation therefore Matlab software is the necessarysoftwareTheMM1 preemptive priority queuemodel is usedin the experiments The arrival of the 119894th level task process as

The Scientific World Journal 5

a Poisson distribution with the parameter 120582119894and service time

as a negative exponential distribution with the parameter120583119894(119894 = 1 2) The 1st level tasks are more priority than the

2nd level communication tasks Assume the parameters are1205821= 170 120582

2= 300 120583

1= 500 and 120583

2= 700

(1) Steady-State Queue Length Figure 6 shows the probabilityand the queue length as the 120583

2increasing The vertical axis

is the probability and the horizontal axis is the queue lengthIn the probability matrix 119875 = 0 the maximum queue lengthcan be obtained in the system and assures that taskrsquos buffer isenough to calculate the taskrsquos loss

In the simulation 119871119904= 40 which is the maximum queue

length when 119875 = 0 the arrivals of the taskrsquos probability are0 this means the possibility of task arrival does not exist andthe length does not grow Then when 119875 = 0 the length canbe regarded as the largest queue length(2) Average Sojourn Time Assume that every level of taskarrival is Poisson distribution The 119894th level tasks are withthe parameter 120582

119894 the service time is the negative exponential

distribution and the average service time is 1120583 The averagesojourn times 119882

1199041and 119882

1199042are calculated in the following

formulas

1199081199041=

1

120583 minus 1205821

1199081199021

= 1199081199041minus

1

120583=

1205821

120583 (120583 minus 1205821)

(1)

1199081199041= (1 +

1205821

1205822

) times (1

120583 minus 1205821minus 1205822

) minus1205821

1205822

times1

120583 minus 1205821

1199081199022

= 1199081199042minus

1

120583

(2)

(3) AverageWaiting Time [22]The sameway the queue of theaverage waiting times 119882

1199021and 119882

1199022is calculated as formula

(1)(4) Wireless Sensor Usage Rate [23] 119875 is the probability of thewireless sensor being idle then 120588 = 1 minus 119875 where 120588 is theoccupancy probability of communication task [24 25] Thegreater 120588 is the greater the occupancy probability is 120588 is theservice capacity or the load capacity To consider the prac-ticality of the model the queue length is not unlimited Todetermine the performance indicators we take the queuingmodel of MM1N and set the buffer capacity which is119898(5) Taskrsquos Throughput The communication taskrsquos time 119879 isdivide into three parts they are the taskrsquos processing time 119879

119894

the state machine processing time 119879119904 and the wireless sensor

idle time119879119903 119879119894+119879119904asymp 119879The taskrsquos processing is more priority

than the state machine processing Assume the tasks servicestrength is 120588

119894 then the tasks processing time is 119879

119894= 120588119894119879 and

the state machine processing time is 119879119904= (1 minus 120588

119894)119879

The processing of the finite automata is the queuingmodel ofMM1N the input processing with the parameter120582119904and the service time with the parameter 120583

119904are the

negative exponential distribution length of the buffer is 119899Theprocessing speed of the communication task is faster than

Queue length

Prob

abili

ty

0

005

01

015

02

5 10 15 20 25 30 35

1205821 = 190 1205822 = 230 1205831 = 450 1205832 = 500

1205821 = 220 1205822 = 230 1205831 = 450 1205832 = 500

1205821 = 170 1205822 = 300 1205831 = 500 1205832 = 500

1205821 = 100 1205822 = 230 1205831 = 450 1205832 = 500

Figure 6 Probability and queue length graph

the processing speed of the state machine Thus the actualprocessing capability of the state machine is 120583

119904119903= (1 minus 120588

119894)120583119904

and the buffer length is119898 then the loss rate is

119875lost =1 minus 120588119904119903

1 minus 120588119898+1119904119903

120588119898

119904119903 (3)

In particular 120588119904119903= 120582119904120583119904119903

As to formula (1) the calculation which the state machinethroughput computes is the following formula

1205820= 120582119904(1 minus

1 minus 120588119904119903

1 minus 120588119898+1119904119903

120588119898

119904119903) (4)

When the sensor network is severely overloading the120582119904≫ 120583119904119903 and the 120588

119904119903≫ 1 As to formula (2) formula (5) is

calculated due to formula (5) and the speed of the parameter120582119894affects the performance of the task processing the greater

120582119894is the lower the performance of the task processing is

When the communication tasks processing rate 120583119894and the

state machine processing rate 120583119903remain unchanged the

performance curve is a straight line in which the slope isminus120583119903120583119894 Consider

1205820asymp 120583119904119903= (1 minus 120588

119894) 120583119903= (1 minus

120582119894

120583119894

)120583119903 (5)

(6) Wireless Sensor Processing Capacity Assume the process-ing capacity is of119873mips the quantity of the tasks which needto be executed in the taskrsquos processing is 119862

1and the quantity

of the tasks which need to be executed in the state machineis1198622 then the taskrsquos processing capacity computes as formula

(3) formula (6) is as follows

120588119904119903=

120582119904

120583119904119903

=120582119894

(1 minus 120588119894) 120583119904

=120582119894

(1 minus (120582119894120583119894)) 120583119904

=120582119894

(1 minus (120582119894 (119873119862

1))) (119873119862

2)=

1205821198941198622

119873 minus 1205821198941198621

(6)

6 The Scientific World Journal

Table 1 Experimental parameters setting

Parameter L7-Filter SnortNum of RegExp 161 166Num of DFA states 1432 1257120573 (expression size) 256 256120595 (relevance frequency) [023 034] [023 034]120578 (match probability) [075 099] [075 099]120574 (similarity) [05 10] [05 10]

Take formula (6) into formula (3) the loss rate 119876 is

119876 = 119875lost =1 minus (120582

1198941198622 (119873 minus 120582

1198941198621))

1 minus [1205821198941198622 (119873 minus 120582

1198941198621)]119898+1

times(1205821198941198622)119898

[119873 minus 1205821198941198621]119898

=(1205821198941198622)119898

sum119898

119894=0[119873 minus 120582

1198941198621]119894

(1205821198941198622)119898minus119894

(7)

Formula (7) is the relationship between the loss rate andthe processing capacity It helps to determine the require-ments of the taskrsquos processing

7 Experiment

71 Experiment Set We evaluated our matching approachby regular expression sets extracted from two real-worldsystems named L7-Filter and Snort L7-Filter is famous opensource application layer traffic classier for LinuxThe payloadcontent of a flow and identified its application level protocolare reassembled through regular expression matching Snortis a well-known open-source intrusion detection systemwhich can be configured to performprotocol analysis probesand content inspecting over online traffic by detecting avariety of worms Two sets are chosen as 119877 = 119903

1 1199032 119903

119899

to perform the experiments The experiment parameters ESMP are set as shown in Table 1Then the local optimal valuecan be obtained during our experiments

Print size denotes the memory occupation of prints afterthe profiteering stage Group number is the group number ofcorrelative regular expression according to the parameter 120574Average similarity is the average value of similarity in eachgroup (see (2)) Package size is the testing packages lengthOur simulation environment is based on NS-2 (NetworkSimulator version 2) We set the number of nodes from 20 to100 Number of suspicious package is the number of packagethat needs to be verified after the profiteering stage Lastly wecalculate our experiment efficiency by their average executingcost Efficiency = (Num of suspicious packageTotal packageNumber) times (119865(119892

119894)Group Number)

Table 2 demonstrates that we can get a good efficiencypromotion from 7317 to 8973 A regular matchingcomparison was performed with our strategy and normalapproach The average hop and average 119865(119866

119894) variation

tendency and the number of nodes are shown in Figure 7L7-Filter and Snort were tested separately 119910-axis is hops and119909-axis indicates the nodes number From the results figure

Average hops on L7

010

50

40

30

20

10

20 30 40 50 60 70 80 90

Average hops on Snort

Nodes

10 20 30 40 50 60 70 80 90Nodes

Hops L7Hops L7 Gi

Hop

s

0

50

40

30

20

10

Hop

s

Hops SnortHops Snort Gi

Figure 7 Results of node average hops in NS-2

a significant difference can be observed when nodes aremorethan 30 the hops number of using 119866

119894decreases sharply

Figure 7 demonstrates that the matching approach cantest and verify the packages efficiently when the number ofwireless nodes is more than 30 which indicates that ourapproach can be well adapted to medium or large scaledistributed wireless sensor network On the other hand thereis no major difference in average hops when the system ishandling a small group of wireless nodes Comparing withother end-to-end strategies [9] our approach provides awell scalable way to construct intrusion detection systemby integrating distributed wireless sensor nodes Based onappropriate parameters network attacks can bemonitored byour system in an effective way

72 Experiment of Queue Model The experiment comparestwo groups of the performance results which computed bythe queuing theory and got the results from the softwareNS2 The NS2 platform simulated the STM32W108 sensornetworking we found that it is affected with the followingparameters the average length of stay for communicationtasks the average queue waiting time of tasks the occupancyrate and the task throughput

The Scientific World Journal 7

Table 2 Experimental data

Parameters

Results L7-Filter Snort1205781= 024

1205742= 077

1205951= 06

1205782= 026

1205742= 0831205952= 5

1205783= 036

1205743= 098

1205953= 10

1205781= 024

1205742= 077

1205951= 06

1205782= 026

1205742= 0831205952= 5

1205783= 036

1205743= 098

1205953= 10

Print size 015MB 031MB 012MB 025MB 039MB 024MBGroup number 14 17 11 14 15 12Average similarity 083 098 095 089 089 097Package size 1024 B 2048 B 4096 B 1024 B 2048 B 4096 BNumber of suspiciouspackage 253 83 122 41 114 48

Efficiency 8973 7317 765 831 7794 8535

Table 3 Experimental data statistics

Parameters

Indicator Queuing theory model calculation results NS2 simulation results1205821= 180 120582

2= 270

1205831= 1205832= 700

119898 = 100

1205821= 150 120582

2= 400

1205831= 1205832= 700

119898 = 35

1205821= 180

1205822= 400

119898 = 100

1205821= 150

1205822= 400

119898 = 35

Queue length 120 40 112 38

Average sojourn time(s) 1198821199041= 00019230

1198821199042= 0005385

1198821199041= 00018182

1198821199042= 0008485

1198821199041= 00018240

1198821199042= 0005062

1198821199041= 00016401

1198821199042= 000849

Average waiting time(s) 1198821199021

= 00004945

1198821199022

= 0004956

1198821199021

= 00003924

1198821199022

= 00069565

1198821199021

= 00003982

1198821199022

= 00045412

1198821199021

= 00002116

1198821199022

= 0006783

Wireless sensor usagerate 955 819 966 883

Sensor networkthroughput 436000 474300 453954 423561

Tasks loss rate 270677 0099 377 0098

Simulation software configuration communication taskstake the high-priority traffic and low-priority communica-tions task two categories Design the taskrsquos scheduling func-tion and assure 119862

1is approximately 400 operations and 119862

2is

about 4000 operationsThe program triggers communicationaccording to the different experimental parameters 120582 and119898 to test the influence on wireless sensor performanceThe experiment of the results compares with calculationresults of the method based on queuing theory to verifythe creditability of the method The statistics are shown inTable 3

When the sensor overloaded the sensor network handlesthe task for a long time and the state machine processing hasno support to the sensor network The actual speed of sensorprocessing 120583

119904119903is far less than 120583

119904 When the wireless sensor

network needed specific requirements 119905 of the loss rate andthe sensor throughput it can take the speed of the schedulingto the requirements

For formula (7) it can understand the relationshipbetween the loss rate and the capacity of scheduling It can

easily choose the right sensor in the network which willgreatly improve the quality of service

73 The Methods of Analysis The previous method of finiteautomata has discussed the regular expression matching sys-tem security in WSN and the evaluation of the performanceis ignored to research The matching method in some extentcan maintain the precision and accuracy in some systems itcan be used in a specific environment the performance of theevaluation in the wireless sensor network (WSN) that we hadresearched is in the universal environment it is necessary toconsider the problem of the restrictions such as the capacityof the buffer the length of the queue in the processing timethe performance of the calculation that needs enough bufferfor the task processing and the work conditions In ourresearch the approach which took the matching methodand the evaluating performance together is a new topic Themethod ensures maintaining the system security reducingthe loss rate of the communication task and improving theaccuracy of the scheduleThe universal approach can be used

8 The Scientific World Journal

in lots of environments in the wireless sensor network theapproach has a good excellent performance

8 Conclusions

This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth

The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)

References

[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014

[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002

[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002

[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003

[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011

[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of

the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999

[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011

[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008

[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005

[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011

[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014

[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013

[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012

[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006

[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012

[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008

[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006

[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006

[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007

[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001

[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000

[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational

The Scientific World Journal 9

approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009

[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011

[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009

[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010

Submit your manuscripts athttpwwwhindawicom

Computer Games Technology

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Distributed Sensor Networks

International Journal of

Advances in

FuzzySystems

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014

International Journal of

ReconfigurableComputing

Hindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Applied Computational Intelligence and Soft Computing

thinspAdvancesthinspinthinsp

Artificial Intelligence

HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014

Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Electrical and Computer Engineering

Journal of

Journal of

Computer Networks and Communications

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporation

httpwwwhindawicom Volume 2014

Advances in

Multimedia

International Journal of

Biomedical Imaging

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

ArtificialNeural Systems

Advances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

RoboticsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Computational Intelligence and Neuroscience

Industrial EngineeringJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Human-ComputerInteraction

Advances in

Computer EngineeringAdvances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World Journal 3

1 2 2

Begin

Begin

Begin

Begin

Begin

Curr

Curr

Curr

Curr

Curr

a[bc]d is selected

2 2

[bc]d is not selected

[bc] is selected

a [bc] [bc]d

1

2

a[ab]d

[bc]

a [bc] [bc]d

a [bc] [bc]d

a [bc] [bc]d

a [bc] [bc]d

512

512

512256

512256

middot is not selected

middot

middot

middot

middot

middot

r1

ri

rn

ri = a[bc]d middot [bc]

d middot is selected

d middot

p1

p1

ps

pk

pm

Figure 2 Process of generating print 119901119894from 119903

119894

5

6

2

4

1

3

7

Package

Prefilteringand getp[1m]

Calculate

F(gi p[1m])

P1P2

Pn

Calculate

F(gi p[1m])

p1p2

pn

Calculate

F(gi p[1m])

p1p2

pn

gi

gi

gi

C1

C2

C3

C4

Figure 3 Matching process of ad hoc packages

The package matching process is demonstrated inFigure 3 Taking the limited computing power of each wire-less node into consideration the calculation of 119865(119892

119894 119901[1119898]

)

is simplified to be addition only At first the feature vector 119901119894

needs to be stored so that the sum of 119901119894can be calculated to

get119865(119892119894 119901[1119898]

)Theprofiteered correlation sequence119901[1sdotsdotsdot119898]

will be generated in node 2 after profiteering stage in node 1Then if 119901

[1sdotsdotsdot119898]is not empty the 119865(119892

119894 119901[1119898]

) is calculatedin node 2 by adding the feature vector 119901

119894 Verifying process

will continue in node 2 using the group 119892119894in its memory

when 119865(119892119894 119901[1119898]

) is larger than 120595 Otherwise the packagewill be transmitted to the next hop and 119892

119895will be matched

continually

4 Queue Model Description [12]

The pattern of communication between wireless sensorscan be divided into two modes the synchronous and theasynchronousmodes In synchronousmode when a pluralityof communication tasks are triggered the tasks schedulingwill be suspended At this moment the levels of querypriority and processes priority are executed in sequenceThismode has a higher efficiency when the transmissions are notfrequent However this will lead to an unacceptable high lossrate of the communication tasks when the transmissions arefrequently triggered In asynchronous mode when the taskto transmit the scheduling will not immediately to processhowever the priority communication tasks are added to thequeue in sequence then the wireless sensor through statemachine to fetch the head of the communication task in

4 The Scientific World Journal

IE IE IEINI0 INI1 INIn

d (x gt 2 y lt 3)

e (x gt

5 ygt 4)

y =

0

a (x lt 2) y = 0

f (x gt 2 y gt 4)

b (xgt2)

ex=

=0y

0

middot middot middot

c (x = 2) y = 0 S0

S1

S2

S3 S4 S5

Figure 4Queuing theorymodel of thewireless sensor networkwith119899 communication taskrsquos scheduling

the queue and executes the task scheduling function Thismodel greatly reduces the tasksrsquo loss thus determining thewireless sensor network (WSN) which is formed in one ofthe biggest communication task captains that are of greathelp to guide sensor network design Figure 4 shows 119899-taskcommunication scheduling based on the queuing theorymodel in the wireless sensor network

Input process communication tasks are divided into 119873

levels The first level has the highest priority the secondpriority has secondary priority and so forth The119873 level hasthe lowest priority Assume that each communication taskinterval is the Poisson distribution or negative exponentialdistribution The average time of the interval of the 119894th levelcommunication task is 120582

119894

Queuing rules the task responses as soon as the com-munication task arrival by the background task executioncall service when the task is not scheduling executed in thesystem The high-priority communication tasks priority isexecuted in sequence until the end of all high-priority tasksin the queue When the low-priority tasks are executing thehigh-priority task takes over the low-priority task and thelow-priority task will return to the queue the same prioritycommunication task followed by FCFS rues

Service process wireless sensor network uses the statemachine to drive communication task process assumingthat each time of the communication task is exponentialdistribution and the average service of level 119894 communicationtask rate is 120583

119894

The WSN communication tasks queue performanceparameters [21] (a) absolute throughput 119860 is the average

00 01 02 03

10

20

30

11

21

31

12

22

32

13

23

33

40 41 42 43

i

j

u21205822

1205822 1205822

1205822

1205822

12058221205822

1205822

1205822

u21205822

u21205822

12058311205821

1205831 12058311205821

12058311205821

12058311205821 12058311205821

12058311205821

1205821 1205821

1205821

1205821

1205831 1205821 1205821

middot middot middot

Figure 5 System state spaces and the transfer process

time of task service in the unit time (b) relative throughput119876 is the ratio of all the severed tasks and all request tasksin the unit time (c) the queue length of the average value119871119904is all communication tasks in the WSN (d) the queue

of average length 119871119902is the average number of the waiting

tasks in the queue (e) the average sojourn times 119882119904are the

average of the taskwaiting for service time119882119902and the average

service time 120591 (then 119882119904= 119882119902+ 120591) (f) busy period 119879

119887is the

random parameter (g) system loss rates 119875loss are the overflowprobability

5 Priority Queue with Two Classes of Tasks

Assume the queuing system is the preemptive priority The119894th task arrival is Poisson distribution with parameter 120582

119894

the service time is exponentially distributed with parameter120583(119894 = 1 2 ) Level 1th priority communication task ismore priority than level 2th priority task The system stateis 119864 = (119894 119895) 0 ⩽ 119894 0 ⩽ 119895 119894(119895) represents the 1(2) level ofthe communication tasksThe system state space distribution119875(119894 119895) = 119875

119894119895 0 ⩽ 119894 0 ⩽ 119895 The system transition process is

depicted in Figure 5

6 Tasks PerformanceIndicators in Sensor Network

The priority tasks processing is as follows when the 1stlevel task with parameters 120582

1and the 2nd level task with

parameters 1205822arrive service times of two level tasks are the

1205831and 120583

2 the taskrsquos priority is reduced in sequence and

they share the waiting queue The recursive calculation ofprobability matrix 119875

119894119895 0 ⩽ 119895 ⩽ 119873 needs a large amount

of calculation therefore Matlab software is the necessarysoftwareTheMM1 preemptive priority queuemodel is usedin the experiments The arrival of the 119894th level task process as

The Scientific World Journal 5

a Poisson distribution with the parameter 120582119894and service time

as a negative exponential distribution with the parameter120583119894(119894 = 1 2) The 1st level tasks are more priority than the

2nd level communication tasks Assume the parameters are1205821= 170 120582

2= 300 120583

1= 500 and 120583

2= 700

(1) Steady-State Queue Length Figure 6 shows the probabilityand the queue length as the 120583

2increasing The vertical axis

is the probability and the horizontal axis is the queue lengthIn the probability matrix 119875 = 0 the maximum queue lengthcan be obtained in the system and assures that taskrsquos buffer isenough to calculate the taskrsquos loss

In the simulation 119871119904= 40 which is the maximum queue

length when 119875 = 0 the arrivals of the taskrsquos probability are0 this means the possibility of task arrival does not exist andthe length does not grow Then when 119875 = 0 the length canbe regarded as the largest queue length(2) Average Sojourn Time Assume that every level of taskarrival is Poisson distribution The 119894th level tasks are withthe parameter 120582

119894 the service time is the negative exponential

distribution and the average service time is 1120583 The averagesojourn times 119882

1199041and 119882

1199042are calculated in the following

formulas

1199081199041=

1

120583 minus 1205821

1199081199021

= 1199081199041minus

1

120583=

1205821

120583 (120583 minus 1205821)

(1)

1199081199041= (1 +

1205821

1205822

) times (1

120583 minus 1205821minus 1205822

) minus1205821

1205822

times1

120583 minus 1205821

1199081199022

= 1199081199042minus

1

120583

(2)

(3) AverageWaiting Time [22]The sameway the queue of theaverage waiting times 119882

1199021and 119882

1199022is calculated as formula

(1)(4) Wireless Sensor Usage Rate [23] 119875 is the probability of thewireless sensor being idle then 120588 = 1 minus 119875 where 120588 is theoccupancy probability of communication task [24 25] Thegreater 120588 is the greater the occupancy probability is 120588 is theservice capacity or the load capacity To consider the prac-ticality of the model the queue length is not unlimited Todetermine the performance indicators we take the queuingmodel of MM1N and set the buffer capacity which is119898(5) Taskrsquos Throughput The communication taskrsquos time 119879 isdivide into three parts they are the taskrsquos processing time 119879

119894

the state machine processing time 119879119904 and the wireless sensor

idle time119879119903 119879119894+119879119904asymp 119879The taskrsquos processing is more priority

than the state machine processing Assume the tasks servicestrength is 120588

119894 then the tasks processing time is 119879

119894= 120588119894119879 and

the state machine processing time is 119879119904= (1 minus 120588

119894)119879

The processing of the finite automata is the queuingmodel ofMM1N the input processing with the parameter120582119904and the service time with the parameter 120583

119904are the

negative exponential distribution length of the buffer is 119899Theprocessing speed of the communication task is faster than

Queue length

Prob

abili

ty

0

005

01

015

02

5 10 15 20 25 30 35

1205821 = 190 1205822 = 230 1205831 = 450 1205832 = 500

1205821 = 220 1205822 = 230 1205831 = 450 1205832 = 500

1205821 = 170 1205822 = 300 1205831 = 500 1205832 = 500

1205821 = 100 1205822 = 230 1205831 = 450 1205832 = 500

Figure 6 Probability and queue length graph

the processing speed of the state machine Thus the actualprocessing capability of the state machine is 120583

119904119903= (1 minus 120588

119894)120583119904

and the buffer length is119898 then the loss rate is

119875lost =1 minus 120588119904119903

1 minus 120588119898+1119904119903

120588119898

119904119903 (3)

In particular 120588119904119903= 120582119904120583119904119903

As to formula (1) the calculation which the state machinethroughput computes is the following formula

1205820= 120582119904(1 minus

1 minus 120588119904119903

1 minus 120588119898+1119904119903

120588119898

119904119903) (4)

When the sensor network is severely overloading the120582119904≫ 120583119904119903 and the 120588

119904119903≫ 1 As to formula (2) formula (5) is

calculated due to formula (5) and the speed of the parameter120582119894affects the performance of the task processing the greater

120582119894is the lower the performance of the task processing is

When the communication tasks processing rate 120583119894and the

state machine processing rate 120583119903remain unchanged the

performance curve is a straight line in which the slope isminus120583119903120583119894 Consider

1205820asymp 120583119904119903= (1 minus 120588

119894) 120583119903= (1 minus

120582119894

120583119894

)120583119903 (5)

(6) Wireless Sensor Processing Capacity Assume the process-ing capacity is of119873mips the quantity of the tasks which needto be executed in the taskrsquos processing is 119862

1and the quantity

of the tasks which need to be executed in the state machineis1198622 then the taskrsquos processing capacity computes as formula

(3) formula (6) is as follows

120588119904119903=

120582119904

120583119904119903

=120582119894

(1 minus 120588119894) 120583119904

=120582119894

(1 minus (120582119894120583119894)) 120583119904

=120582119894

(1 minus (120582119894 (119873119862

1))) (119873119862

2)=

1205821198941198622

119873 minus 1205821198941198621

(6)

6 The Scientific World Journal

Table 1 Experimental parameters setting

Parameter L7-Filter SnortNum of RegExp 161 166Num of DFA states 1432 1257120573 (expression size) 256 256120595 (relevance frequency) [023 034] [023 034]120578 (match probability) [075 099] [075 099]120574 (similarity) [05 10] [05 10]

Take formula (6) into formula (3) the loss rate 119876 is

119876 = 119875lost =1 minus (120582

1198941198622 (119873 minus 120582

1198941198621))

1 minus [1205821198941198622 (119873 minus 120582

1198941198621)]119898+1

times(1205821198941198622)119898

[119873 minus 1205821198941198621]119898

=(1205821198941198622)119898

sum119898

119894=0[119873 minus 120582

1198941198621]119894

(1205821198941198622)119898minus119894

(7)

Formula (7) is the relationship between the loss rate andthe processing capacity It helps to determine the require-ments of the taskrsquos processing

7 Experiment

71 Experiment Set We evaluated our matching approachby regular expression sets extracted from two real-worldsystems named L7-Filter and Snort L7-Filter is famous opensource application layer traffic classier for LinuxThe payloadcontent of a flow and identified its application level protocolare reassembled through regular expression matching Snortis a well-known open-source intrusion detection systemwhich can be configured to performprotocol analysis probesand content inspecting over online traffic by detecting avariety of worms Two sets are chosen as 119877 = 119903

1 1199032 119903

119899

to perform the experiments The experiment parameters ESMP are set as shown in Table 1Then the local optimal valuecan be obtained during our experiments

Print size denotes the memory occupation of prints afterthe profiteering stage Group number is the group number ofcorrelative regular expression according to the parameter 120574Average similarity is the average value of similarity in eachgroup (see (2)) Package size is the testing packages lengthOur simulation environment is based on NS-2 (NetworkSimulator version 2) We set the number of nodes from 20 to100 Number of suspicious package is the number of packagethat needs to be verified after the profiteering stage Lastly wecalculate our experiment efficiency by their average executingcost Efficiency = (Num of suspicious packageTotal packageNumber) times (119865(119892

119894)Group Number)

Table 2 demonstrates that we can get a good efficiencypromotion from 7317 to 8973 A regular matchingcomparison was performed with our strategy and normalapproach The average hop and average 119865(119866

119894) variation

tendency and the number of nodes are shown in Figure 7L7-Filter and Snort were tested separately 119910-axis is hops and119909-axis indicates the nodes number From the results figure

Average hops on L7

010

50

40

30

20

10

20 30 40 50 60 70 80 90

Average hops on Snort

Nodes

10 20 30 40 50 60 70 80 90Nodes

Hops L7Hops L7 Gi

Hop

s

0

50

40

30

20

10

Hop

s

Hops SnortHops Snort Gi

Figure 7 Results of node average hops in NS-2

a significant difference can be observed when nodes aremorethan 30 the hops number of using 119866

119894decreases sharply

Figure 7 demonstrates that the matching approach cantest and verify the packages efficiently when the number ofwireless nodes is more than 30 which indicates that ourapproach can be well adapted to medium or large scaledistributed wireless sensor network On the other hand thereis no major difference in average hops when the system ishandling a small group of wireless nodes Comparing withother end-to-end strategies [9] our approach provides awell scalable way to construct intrusion detection systemby integrating distributed wireless sensor nodes Based onappropriate parameters network attacks can bemonitored byour system in an effective way

72 Experiment of Queue Model The experiment comparestwo groups of the performance results which computed bythe queuing theory and got the results from the softwareNS2 The NS2 platform simulated the STM32W108 sensornetworking we found that it is affected with the followingparameters the average length of stay for communicationtasks the average queue waiting time of tasks the occupancyrate and the task throughput

The Scientific World Journal 7

Table 2 Experimental data

Parameters

Results L7-Filter Snort1205781= 024

1205742= 077

1205951= 06

1205782= 026

1205742= 0831205952= 5

1205783= 036

1205743= 098

1205953= 10

1205781= 024

1205742= 077

1205951= 06

1205782= 026

1205742= 0831205952= 5

1205783= 036

1205743= 098

1205953= 10

Print size 015MB 031MB 012MB 025MB 039MB 024MBGroup number 14 17 11 14 15 12Average similarity 083 098 095 089 089 097Package size 1024 B 2048 B 4096 B 1024 B 2048 B 4096 BNumber of suspiciouspackage 253 83 122 41 114 48

Efficiency 8973 7317 765 831 7794 8535

Table 3 Experimental data statistics

Parameters

Indicator Queuing theory model calculation results NS2 simulation results1205821= 180 120582

2= 270

1205831= 1205832= 700

119898 = 100

1205821= 150 120582

2= 400

1205831= 1205832= 700

119898 = 35

1205821= 180

1205822= 400

119898 = 100

1205821= 150

1205822= 400

119898 = 35

Queue length 120 40 112 38

Average sojourn time(s) 1198821199041= 00019230

1198821199042= 0005385

1198821199041= 00018182

1198821199042= 0008485

1198821199041= 00018240

1198821199042= 0005062

1198821199041= 00016401

1198821199042= 000849

Average waiting time(s) 1198821199021

= 00004945

1198821199022

= 0004956

1198821199021

= 00003924

1198821199022

= 00069565

1198821199021

= 00003982

1198821199022

= 00045412

1198821199021

= 00002116

1198821199022

= 0006783

Wireless sensor usagerate 955 819 966 883

Sensor networkthroughput 436000 474300 453954 423561

Tasks loss rate 270677 0099 377 0098

Simulation software configuration communication taskstake the high-priority traffic and low-priority communica-tions task two categories Design the taskrsquos scheduling func-tion and assure 119862

1is approximately 400 operations and 119862

2is

about 4000 operationsThe program triggers communicationaccording to the different experimental parameters 120582 and119898 to test the influence on wireless sensor performanceThe experiment of the results compares with calculationresults of the method based on queuing theory to verifythe creditability of the method The statistics are shown inTable 3

When the sensor overloaded the sensor network handlesthe task for a long time and the state machine processing hasno support to the sensor network The actual speed of sensorprocessing 120583

119904119903is far less than 120583

119904 When the wireless sensor

network needed specific requirements 119905 of the loss rate andthe sensor throughput it can take the speed of the schedulingto the requirements

For formula (7) it can understand the relationshipbetween the loss rate and the capacity of scheduling It can

easily choose the right sensor in the network which willgreatly improve the quality of service

73 The Methods of Analysis The previous method of finiteautomata has discussed the regular expression matching sys-tem security in WSN and the evaluation of the performanceis ignored to research The matching method in some extentcan maintain the precision and accuracy in some systems itcan be used in a specific environment the performance of theevaluation in the wireless sensor network (WSN) that we hadresearched is in the universal environment it is necessary toconsider the problem of the restrictions such as the capacityof the buffer the length of the queue in the processing timethe performance of the calculation that needs enough bufferfor the task processing and the work conditions In ourresearch the approach which took the matching methodand the evaluating performance together is a new topic Themethod ensures maintaining the system security reducingthe loss rate of the communication task and improving theaccuracy of the scheduleThe universal approach can be used

8 The Scientific World Journal

in lots of environments in the wireless sensor network theapproach has a good excellent performance

8 Conclusions

This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth

The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)

References

[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014

[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002

[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002

[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003

[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011

[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of

the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999

[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011

[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008

[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005

[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011

[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014

[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013

[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012

[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006

[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012

[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008

[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006

[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006

[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007

[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001

[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000

[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational

The Scientific World Journal 9

approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009

[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011

[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009

[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010

Submit your manuscripts athttpwwwhindawicom

Computer Games Technology

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Distributed Sensor Networks

International Journal of

Advances in

FuzzySystems

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014

International Journal of

ReconfigurableComputing

Hindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Applied Computational Intelligence and Soft Computing

thinspAdvancesthinspinthinsp

Artificial Intelligence

HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014

Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Electrical and Computer Engineering

Journal of

Journal of

Computer Networks and Communications

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporation

httpwwwhindawicom Volume 2014

Advances in

Multimedia

International Journal of

Biomedical Imaging

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

ArtificialNeural Systems

Advances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

RoboticsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Computational Intelligence and Neuroscience

Industrial EngineeringJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Human-ComputerInteraction

Advances in

Computer EngineeringAdvances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

4 The Scientific World Journal

IE IE IEINI0 INI1 INIn

d (x gt 2 y lt 3)

e (x gt

5 ygt 4)

y =

0

a (x lt 2) y = 0

f (x gt 2 y gt 4)

b (xgt2)

ex=

=0y

0

middot middot middot

c (x = 2) y = 0 S0

S1

S2

S3 S4 S5

Figure 4Queuing theorymodel of thewireless sensor networkwith119899 communication taskrsquos scheduling

the queue and executes the task scheduling function Thismodel greatly reduces the tasksrsquo loss thus determining thewireless sensor network (WSN) which is formed in one ofthe biggest communication task captains that are of greathelp to guide sensor network design Figure 4 shows 119899-taskcommunication scheduling based on the queuing theorymodel in the wireless sensor network

Input process communication tasks are divided into 119873

levels The first level has the highest priority the secondpriority has secondary priority and so forth The119873 level hasthe lowest priority Assume that each communication taskinterval is the Poisson distribution or negative exponentialdistribution The average time of the interval of the 119894th levelcommunication task is 120582

119894

Queuing rules the task responses as soon as the com-munication task arrival by the background task executioncall service when the task is not scheduling executed in thesystem The high-priority communication tasks priority isexecuted in sequence until the end of all high-priority tasksin the queue When the low-priority tasks are executing thehigh-priority task takes over the low-priority task and thelow-priority task will return to the queue the same prioritycommunication task followed by FCFS rues

Service process wireless sensor network uses the statemachine to drive communication task process assumingthat each time of the communication task is exponentialdistribution and the average service of level 119894 communicationtask rate is 120583

119894

The WSN communication tasks queue performanceparameters [21] (a) absolute throughput 119860 is the average

00 01 02 03

10

20

30

11

21

31

12

22

32

13

23

33

40 41 42 43

i

j

u21205822

1205822 1205822

1205822

1205822

12058221205822

1205822

1205822

u21205822

u21205822

12058311205821

1205831 12058311205821

12058311205821

12058311205821 12058311205821

12058311205821

1205821 1205821

1205821

1205821

1205831 1205821 1205821

middot middot middot

Figure 5 System state spaces and the transfer process

time of task service in the unit time (b) relative throughput119876 is the ratio of all the severed tasks and all request tasksin the unit time (c) the queue length of the average value119871119904is all communication tasks in the WSN (d) the queue

of average length 119871119902is the average number of the waiting

tasks in the queue (e) the average sojourn times 119882119904are the

average of the taskwaiting for service time119882119902and the average

service time 120591 (then 119882119904= 119882119902+ 120591) (f) busy period 119879

119887is the

random parameter (g) system loss rates 119875loss are the overflowprobability

5 Priority Queue with Two Classes of Tasks

Assume the queuing system is the preemptive priority The119894th task arrival is Poisson distribution with parameter 120582

119894

the service time is exponentially distributed with parameter120583(119894 = 1 2 ) Level 1th priority communication task ismore priority than level 2th priority task The system stateis 119864 = (119894 119895) 0 ⩽ 119894 0 ⩽ 119895 119894(119895) represents the 1(2) level ofthe communication tasksThe system state space distribution119875(119894 119895) = 119875

119894119895 0 ⩽ 119894 0 ⩽ 119895 The system transition process is

depicted in Figure 5

6 Tasks PerformanceIndicators in Sensor Network

The priority tasks processing is as follows when the 1stlevel task with parameters 120582

1and the 2nd level task with

parameters 1205822arrive service times of two level tasks are the

1205831and 120583

2 the taskrsquos priority is reduced in sequence and

they share the waiting queue The recursive calculation ofprobability matrix 119875

119894119895 0 ⩽ 119895 ⩽ 119873 needs a large amount

of calculation therefore Matlab software is the necessarysoftwareTheMM1 preemptive priority queuemodel is usedin the experiments The arrival of the 119894th level task process as

The Scientific World Journal 5

a Poisson distribution with the parameter 120582119894and service time

as a negative exponential distribution with the parameter120583119894(119894 = 1 2) The 1st level tasks are more priority than the

2nd level communication tasks Assume the parameters are1205821= 170 120582

2= 300 120583

1= 500 and 120583

2= 700

(1) Steady-State Queue Length Figure 6 shows the probabilityand the queue length as the 120583

2increasing The vertical axis

is the probability and the horizontal axis is the queue lengthIn the probability matrix 119875 = 0 the maximum queue lengthcan be obtained in the system and assures that taskrsquos buffer isenough to calculate the taskrsquos loss

In the simulation 119871119904= 40 which is the maximum queue

length when 119875 = 0 the arrivals of the taskrsquos probability are0 this means the possibility of task arrival does not exist andthe length does not grow Then when 119875 = 0 the length canbe regarded as the largest queue length(2) Average Sojourn Time Assume that every level of taskarrival is Poisson distribution The 119894th level tasks are withthe parameter 120582

119894 the service time is the negative exponential

distribution and the average service time is 1120583 The averagesojourn times 119882

1199041and 119882

1199042are calculated in the following

formulas

1199081199041=

1

120583 minus 1205821

1199081199021

= 1199081199041minus

1

120583=

1205821

120583 (120583 minus 1205821)

(1)

1199081199041= (1 +

1205821

1205822

) times (1

120583 minus 1205821minus 1205822

) minus1205821

1205822

times1

120583 minus 1205821

1199081199022

= 1199081199042minus

1

120583

(2)

(3) AverageWaiting Time [22]The sameway the queue of theaverage waiting times 119882

1199021and 119882

1199022is calculated as formula

(1)(4) Wireless Sensor Usage Rate [23] 119875 is the probability of thewireless sensor being idle then 120588 = 1 minus 119875 where 120588 is theoccupancy probability of communication task [24 25] Thegreater 120588 is the greater the occupancy probability is 120588 is theservice capacity or the load capacity To consider the prac-ticality of the model the queue length is not unlimited Todetermine the performance indicators we take the queuingmodel of MM1N and set the buffer capacity which is119898(5) Taskrsquos Throughput The communication taskrsquos time 119879 isdivide into three parts they are the taskrsquos processing time 119879

119894

the state machine processing time 119879119904 and the wireless sensor

idle time119879119903 119879119894+119879119904asymp 119879The taskrsquos processing is more priority

than the state machine processing Assume the tasks servicestrength is 120588

119894 then the tasks processing time is 119879

119894= 120588119894119879 and

the state machine processing time is 119879119904= (1 minus 120588

119894)119879

The processing of the finite automata is the queuingmodel ofMM1N the input processing with the parameter120582119904and the service time with the parameter 120583

119904are the

negative exponential distribution length of the buffer is 119899Theprocessing speed of the communication task is faster than

Queue length

Prob

abili

ty

0

005

01

015

02

5 10 15 20 25 30 35

1205821 = 190 1205822 = 230 1205831 = 450 1205832 = 500

1205821 = 220 1205822 = 230 1205831 = 450 1205832 = 500

1205821 = 170 1205822 = 300 1205831 = 500 1205832 = 500

1205821 = 100 1205822 = 230 1205831 = 450 1205832 = 500

Figure 6 Probability and queue length graph

the processing speed of the state machine Thus the actualprocessing capability of the state machine is 120583

119904119903= (1 minus 120588

119894)120583119904

and the buffer length is119898 then the loss rate is

119875lost =1 minus 120588119904119903

1 minus 120588119898+1119904119903

120588119898

119904119903 (3)

In particular 120588119904119903= 120582119904120583119904119903

As to formula (1) the calculation which the state machinethroughput computes is the following formula

1205820= 120582119904(1 minus

1 minus 120588119904119903

1 minus 120588119898+1119904119903

120588119898

119904119903) (4)

When the sensor network is severely overloading the120582119904≫ 120583119904119903 and the 120588

119904119903≫ 1 As to formula (2) formula (5) is

calculated due to formula (5) and the speed of the parameter120582119894affects the performance of the task processing the greater

120582119894is the lower the performance of the task processing is

When the communication tasks processing rate 120583119894and the

state machine processing rate 120583119903remain unchanged the

performance curve is a straight line in which the slope isminus120583119903120583119894 Consider

1205820asymp 120583119904119903= (1 minus 120588

119894) 120583119903= (1 minus

120582119894

120583119894

)120583119903 (5)

(6) Wireless Sensor Processing Capacity Assume the process-ing capacity is of119873mips the quantity of the tasks which needto be executed in the taskrsquos processing is 119862

1and the quantity

of the tasks which need to be executed in the state machineis1198622 then the taskrsquos processing capacity computes as formula

(3) formula (6) is as follows

120588119904119903=

120582119904

120583119904119903

=120582119894

(1 minus 120588119894) 120583119904

=120582119894

(1 minus (120582119894120583119894)) 120583119904

=120582119894

(1 minus (120582119894 (119873119862

1))) (119873119862

2)=

1205821198941198622

119873 minus 1205821198941198621

(6)

6 The Scientific World Journal

Table 1 Experimental parameters setting

Parameter L7-Filter SnortNum of RegExp 161 166Num of DFA states 1432 1257120573 (expression size) 256 256120595 (relevance frequency) [023 034] [023 034]120578 (match probability) [075 099] [075 099]120574 (similarity) [05 10] [05 10]

Take formula (6) into formula (3) the loss rate 119876 is

119876 = 119875lost =1 minus (120582

1198941198622 (119873 minus 120582

1198941198621))

1 minus [1205821198941198622 (119873 minus 120582

1198941198621)]119898+1

times(1205821198941198622)119898

[119873 minus 1205821198941198621]119898

=(1205821198941198622)119898

sum119898

119894=0[119873 minus 120582

1198941198621]119894

(1205821198941198622)119898minus119894

(7)

Formula (7) is the relationship between the loss rate andthe processing capacity It helps to determine the require-ments of the taskrsquos processing

7 Experiment

71 Experiment Set We evaluated our matching approachby regular expression sets extracted from two real-worldsystems named L7-Filter and Snort L7-Filter is famous opensource application layer traffic classier for LinuxThe payloadcontent of a flow and identified its application level protocolare reassembled through regular expression matching Snortis a well-known open-source intrusion detection systemwhich can be configured to performprotocol analysis probesand content inspecting over online traffic by detecting avariety of worms Two sets are chosen as 119877 = 119903

1 1199032 119903

119899

to perform the experiments The experiment parameters ESMP are set as shown in Table 1Then the local optimal valuecan be obtained during our experiments

Print size denotes the memory occupation of prints afterthe profiteering stage Group number is the group number ofcorrelative regular expression according to the parameter 120574Average similarity is the average value of similarity in eachgroup (see (2)) Package size is the testing packages lengthOur simulation environment is based on NS-2 (NetworkSimulator version 2) We set the number of nodes from 20 to100 Number of suspicious package is the number of packagethat needs to be verified after the profiteering stage Lastly wecalculate our experiment efficiency by their average executingcost Efficiency = (Num of suspicious packageTotal packageNumber) times (119865(119892

119894)Group Number)

Table 2 demonstrates that we can get a good efficiencypromotion from 7317 to 8973 A regular matchingcomparison was performed with our strategy and normalapproach The average hop and average 119865(119866

119894) variation

tendency and the number of nodes are shown in Figure 7L7-Filter and Snort were tested separately 119910-axis is hops and119909-axis indicates the nodes number From the results figure

Average hops on L7

010

50

40

30

20

10

20 30 40 50 60 70 80 90

Average hops on Snort

Nodes

10 20 30 40 50 60 70 80 90Nodes

Hops L7Hops L7 Gi

Hop

s

0

50

40

30

20

10

Hop

s

Hops SnortHops Snort Gi

Figure 7 Results of node average hops in NS-2

a significant difference can be observed when nodes aremorethan 30 the hops number of using 119866

119894decreases sharply

Figure 7 demonstrates that the matching approach cantest and verify the packages efficiently when the number ofwireless nodes is more than 30 which indicates that ourapproach can be well adapted to medium or large scaledistributed wireless sensor network On the other hand thereis no major difference in average hops when the system ishandling a small group of wireless nodes Comparing withother end-to-end strategies [9] our approach provides awell scalable way to construct intrusion detection systemby integrating distributed wireless sensor nodes Based onappropriate parameters network attacks can bemonitored byour system in an effective way

72 Experiment of Queue Model The experiment comparestwo groups of the performance results which computed bythe queuing theory and got the results from the softwareNS2 The NS2 platform simulated the STM32W108 sensornetworking we found that it is affected with the followingparameters the average length of stay for communicationtasks the average queue waiting time of tasks the occupancyrate and the task throughput

The Scientific World Journal 7

Table 2 Experimental data

Parameters

Results L7-Filter Snort1205781= 024

1205742= 077

1205951= 06

1205782= 026

1205742= 0831205952= 5

1205783= 036

1205743= 098

1205953= 10

1205781= 024

1205742= 077

1205951= 06

1205782= 026

1205742= 0831205952= 5

1205783= 036

1205743= 098

1205953= 10

Print size 015MB 031MB 012MB 025MB 039MB 024MBGroup number 14 17 11 14 15 12Average similarity 083 098 095 089 089 097Package size 1024 B 2048 B 4096 B 1024 B 2048 B 4096 BNumber of suspiciouspackage 253 83 122 41 114 48

Efficiency 8973 7317 765 831 7794 8535

Table 3 Experimental data statistics

Parameters

Indicator Queuing theory model calculation results NS2 simulation results1205821= 180 120582

2= 270

1205831= 1205832= 700

119898 = 100

1205821= 150 120582

2= 400

1205831= 1205832= 700

119898 = 35

1205821= 180

1205822= 400

119898 = 100

1205821= 150

1205822= 400

119898 = 35

Queue length 120 40 112 38

Average sojourn time(s) 1198821199041= 00019230

1198821199042= 0005385

1198821199041= 00018182

1198821199042= 0008485

1198821199041= 00018240

1198821199042= 0005062

1198821199041= 00016401

1198821199042= 000849

Average waiting time(s) 1198821199021

= 00004945

1198821199022

= 0004956

1198821199021

= 00003924

1198821199022

= 00069565

1198821199021

= 00003982

1198821199022

= 00045412

1198821199021

= 00002116

1198821199022

= 0006783

Wireless sensor usagerate 955 819 966 883

Sensor networkthroughput 436000 474300 453954 423561

Tasks loss rate 270677 0099 377 0098

Simulation software configuration communication taskstake the high-priority traffic and low-priority communica-tions task two categories Design the taskrsquos scheduling func-tion and assure 119862

1is approximately 400 operations and 119862

2is

about 4000 operationsThe program triggers communicationaccording to the different experimental parameters 120582 and119898 to test the influence on wireless sensor performanceThe experiment of the results compares with calculationresults of the method based on queuing theory to verifythe creditability of the method The statistics are shown inTable 3

When the sensor overloaded the sensor network handlesthe task for a long time and the state machine processing hasno support to the sensor network The actual speed of sensorprocessing 120583

119904119903is far less than 120583

119904 When the wireless sensor

network needed specific requirements 119905 of the loss rate andthe sensor throughput it can take the speed of the schedulingto the requirements

For formula (7) it can understand the relationshipbetween the loss rate and the capacity of scheduling It can

easily choose the right sensor in the network which willgreatly improve the quality of service

73 The Methods of Analysis The previous method of finiteautomata has discussed the regular expression matching sys-tem security in WSN and the evaluation of the performanceis ignored to research The matching method in some extentcan maintain the precision and accuracy in some systems itcan be used in a specific environment the performance of theevaluation in the wireless sensor network (WSN) that we hadresearched is in the universal environment it is necessary toconsider the problem of the restrictions such as the capacityof the buffer the length of the queue in the processing timethe performance of the calculation that needs enough bufferfor the task processing and the work conditions In ourresearch the approach which took the matching methodand the evaluating performance together is a new topic Themethod ensures maintaining the system security reducingthe loss rate of the communication task and improving theaccuracy of the scheduleThe universal approach can be used

8 The Scientific World Journal

in lots of environments in the wireless sensor network theapproach has a good excellent performance

8 Conclusions

This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth

The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)

References

[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014

[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002

[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002

[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003

[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011

[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of

the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999

[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011

[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008

[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005

[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011

[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014

[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013

[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012

[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006

[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012

[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008

[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006

[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006

[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007

[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001

[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000

[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational

The Scientific World Journal 9

approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009

[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011

[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009

[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010

Submit your manuscripts athttpwwwhindawicom

Computer Games Technology

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Distributed Sensor Networks

International Journal of

Advances in

FuzzySystems

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014

International Journal of

ReconfigurableComputing

Hindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Applied Computational Intelligence and Soft Computing

thinspAdvancesthinspinthinsp

Artificial Intelligence

HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014

Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Electrical and Computer Engineering

Journal of

Journal of

Computer Networks and Communications

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporation

httpwwwhindawicom Volume 2014

Advances in

Multimedia

International Journal of

Biomedical Imaging

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

ArtificialNeural Systems

Advances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

RoboticsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Computational Intelligence and Neuroscience

Industrial EngineeringJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Human-ComputerInteraction

Advances in

Computer EngineeringAdvances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World Journal 5

a Poisson distribution with the parameter 120582119894and service time

as a negative exponential distribution with the parameter120583119894(119894 = 1 2) The 1st level tasks are more priority than the

2nd level communication tasks Assume the parameters are1205821= 170 120582

2= 300 120583

1= 500 and 120583

2= 700

(1) Steady-State Queue Length Figure 6 shows the probabilityand the queue length as the 120583

2increasing The vertical axis

is the probability and the horizontal axis is the queue lengthIn the probability matrix 119875 = 0 the maximum queue lengthcan be obtained in the system and assures that taskrsquos buffer isenough to calculate the taskrsquos loss

In the simulation 119871119904= 40 which is the maximum queue

length when 119875 = 0 the arrivals of the taskrsquos probability are0 this means the possibility of task arrival does not exist andthe length does not grow Then when 119875 = 0 the length canbe regarded as the largest queue length(2) Average Sojourn Time Assume that every level of taskarrival is Poisson distribution The 119894th level tasks are withthe parameter 120582

119894 the service time is the negative exponential

distribution and the average service time is 1120583 The averagesojourn times 119882

1199041and 119882

1199042are calculated in the following

formulas

1199081199041=

1

120583 minus 1205821

1199081199021

= 1199081199041minus

1

120583=

1205821

120583 (120583 minus 1205821)

(1)

1199081199041= (1 +

1205821

1205822

) times (1

120583 minus 1205821minus 1205822

) minus1205821

1205822

times1

120583 minus 1205821

1199081199022

= 1199081199042minus

1

120583

(2)

(3) AverageWaiting Time [22]The sameway the queue of theaverage waiting times 119882

1199021and 119882

1199022is calculated as formula

(1)(4) Wireless Sensor Usage Rate [23] 119875 is the probability of thewireless sensor being idle then 120588 = 1 minus 119875 where 120588 is theoccupancy probability of communication task [24 25] Thegreater 120588 is the greater the occupancy probability is 120588 is theservice capacity or the load capacity To consider the prac-ticality of the model the queue length is not unlimited Todetermine the performance indicators we take the queuingmodel of MM1N and set the buffer capacity which is119898(5) Taskrsquos Throughput The communication taskrsquos time 119879 isdivide into three parts they are the taskrsquos processing time 119879

119894

the state machine processing time 119879119904 and the wireless sensor

idle time119879119903 119879119894+119879119904asymp 119879The taskrsquos processing is more priority

than the state machine processing Assume the tasks servicestrength is 120588

119894 then the tasks processing time is 119879

119894= 120588119894119879 and

the state machine processing time is 119879119904= (1 minus 120588

119894)119879

The processing of the finite automata is the queuingmodel ofMM1N the input processing with the parameter120582119904and the service time with the parameter 120583

119904are the

negative exponential distribution length of the buffer is 119899Theprocessing speed of the communication task is faster than

Queue length

Prob

abili

ty

0

005

01

015

02

5 10 15 20 25 30 35

1205821 = 190 1205822 = 230 1205831 = 450 1205832 = 500

1205821 = 220 1205822 = 230 1205831 = 450 1205832 = 500

1205821 = 170 1205822 = 300 1205831 = 500 1205832 = 500

1205821 = 100 1205822 = 230 1205831 = 450 1205832 = 500

Figure 6 Probability and queue length graph

the processing speed of the state machine Thus the actualprocessing capability of the state machine is 120583

119904119903= (1 minus 120588

119894)120583119904

and the buffer length is119898 then the loss rate is

119875lost =1 minus 120588119904119903

1 minus 120588119898+1119904119903

120588119898

119904119903 (3)

In particular 120588119904119903= 120582119904120583119904119903

As to formula (1) the calculation which the state machinethroughput computes is the following formula

1205820= 120582119904(1 minus

1 minus 120588119904119903

1 minus 120588119898+1119904119903

120588119898

119904119903) (4)

When the sensor network is severely overloading the120582119904≫ 120583119904119903 and the 120588

119904119903≫ 1 As to formula (2) formula (5) is

calculated due to formula (5) and the speed of the parameter120582119894affects the performance of the task processing the greater

120582119894is the lower the performance of the task processing is

When the communication tasks processing rate 120583119894and the

state machine processing rate 120583119903remain unchanged the

performance curve is a straight line in which the slope isminus120583119903120583119894 Consider

1205820asymp 120583119904119903= (1 minus 120588

119894) 120583119903= (1 minus

120582119894

120583119894

)120583119903 (5)

(6) Wireless Sensor Processing Capacity Assume the process-ing capacity is of119873mips the quantity of the tasks which needto be executed in the taskrsquos processing is 119862

1and the quantity

of the tasks which need to be executed in the state machineis1198622 then the taskrsquos processing capacity computes as formula

(3) formula (6) is as follows

120588119904119903=

120582119904

120583119904119903

=120582119894

(1 minus 120588119894) 120583119904

=120582119894

(1 minus (120582119894120583119894)) 120583119904

=120582119894

(1 minus (120582119894 (119873119862

1))) (119873119862

2)=

1205821198941198622

119873 minus 1205821198941198621

(6)

6 The Scientific World Journal

Table 1 Experimental parameters setting

Parameter L7-Filter SnortNum of RegExp 161 166Num of DFA states 1432 1257120573 (expression size) 256 256120595 (relevance frequency) [023 034] [023 034]120578 (match probability) [075 099] [075 099]120574 (similarity) [05 10] [05 10]

Take formula (6) into formula (3) the loss rate 119876 is

119876 = 119875lost =1 minus (120582

1198941198622 (119873 minus 120582

1198941198621))

1 minus [1205821198941198622 (119873 minus 120582

1198941198621)]119898+1

times(1205821198941198622)119898

[119873 minus 1205821198941198621]119898

=(1205821198941198622)119898

sum119898

119894=0[119873 minus 120582

1198941198621]119894

(1205821198941198622)119898minus119894

(7)

Formula (7) is the relationship between the loss rate andthe processing capacity It helps to determine the require-ments of the taskrsquos processing

7 Experiment

71 Experiment Set We evaluated our matching approachby regular expression sets extracted from two real-worldsystems named L7-Filter and Snort L7-Filter is famous opensource application layer traffic classier for LinuxThe payloadcontent of a flow and identified its application level protocolare reassembled through regular expression matching Snortis a well-known open-source intrusion detection systemwhich can be configured to performprotocol analysis probesand content inspecting over online traffic by detecting avariety of worms Two sets are chosen as 119877 = 119903

1 1199032 119903

119899

to perform the experiments The experiment parameters ESMP are set as shown in Table 1Then the local optimal valuecan be obtained during our experiments

Print size denotes the memory occupation of prints afterthe profiteering stage Group number is the group number ofcorrelative regular expression according to the parameter 120574Average similarity is the average value of similarity in eachgroup (see (2)) Package size is the testing packages lengthOur simulation environment is based on NS-2 (NetworkSimulator version 2) We set the number of nodes from 20 to100 Number of suspicious package is the number of packagethat needs to be verified after the profiteering stage Lastly wecalculate our experiment efficiency by their average executingcost Efficiency = (Num of suspicious packageTotal packageNumber) times (119865(119892

119894)Group Number)

Table 2 demonstrates that we can get a good efficiencypromotion from 7317 to 8973 A regular matchingcomparison was performed with our strategy and normalapproach The average hop and average 119865(119866

119894) variation

tendency and the number of nodes are shown in Figure 7L7-Filter and Snort were tested separately 119910-axis is hops and119909-axis indicates the nodes number From the results figure

Average hops on L7

010

50

40

30

20

10

20 30 40 50 60 70 80 90

Average hops on Snort

Nodes

10 20 30 40 50 60 70 80 90Nodes

Hops L7Hops L7 Gi

Hop

s

0

50

40

30

20

10

Hop

s

Hops SnortHops Snort Gi

Figure 7 Results of node average hops in NS-2

a significant difference can be observed when nodes aremorethan 30 the hops number of using 119866

119894decreases sharply

Figure 7 demonstrates that the matching approach cantest and verify the packages efficiently when the number ofwireless nodes is more than 30 which indicates that ourapproach can be well adapted to medium or large scaledistributed wireless sensor network On the other hand thereis no major difference in average hops when the system ishandling a small group of wireless nodes Comparing withother end-to-end strategies [9] our approach provides awell scalable way to construct intrusion detection systemby integrating distributed wireless sensor nodes Based onappropriate parameters network attacks can bemonitored byour system in an effective way

72 Experiment of Queue Model The experiment comparestwo groups of the performance results which computed bythe queuing theory and got the results from the softwareNS2 The NS2 platform simulated the STM32W108 sensornetworking we found that it is affected with the followingparameters the average length of stay for communicationtasks the average queue waiting time of tasks the occupancyrate and the task throughput

The Scientific World Journal 7

Table 2 Experimental data

Parameters

Results L7-Filter Snort1205781= 024

1205742= 077

1205951= 06

1205782= 026

1205742= 0831205952= 5

1205783= 036

1205743= 098

1205953= 10

1205781= 024

1205742= 077

1205951= 06

1205782= 026

1205742= 0831205952= 5

1205783= 036

1205743= 098

1205953= 10

Print size 015MB 031MB 012MB 025MB 039MB 024MBGroup number 14 17 11 14 15 12Average similarity 083 098 095 089 089 097Package size 1024 B 2048 B 4096 B 1024 B 2048 B 4096 BNumber of suspiciouspackage 253 83 122 41 114 48

Efficiency 8973 7317 765 831 7794 8535

Table 3 Experimental data statistics

Parameters

Indicator Queuing theory model calculation results NS2 simulation results1205821= 180 120582

2= 270

1205831= 1205832= 700

119898 = 100

1205821= 150 120582

2= 400

1205831= 1205832= 700

119898 = 35

1205821= 180

1205822= 400

119898 = 100

1205821= 150

1205822= 400

119898 = 35

Queue length 120 40 112 38

Average sojourn time(s) 1198821199041= 00019230

1198821199042= 0005385

1198821199041= 00018182

1198821199042= 0008485

1198821199041= 00018240

1198821199042= 0005062

1198821199041= 00016401

1198821199042= 000849

Average waiting time(s) 1198821199021

= 00004945

1198821199022

= 0004956

1198821199021

= 00003924

1198821199022

= 00069565

1198821199021

= 00003982

1198821199022

= 00045412

1198821199021

= 00002116

1198821199022

= 0006783

Wireless sensor usagerate 955 819 966 883

Sensor networkthroughput 436000 474300 453954 423561

Tasks loss rate 270677 0099 377 0098

Simulation software configuration communication taskstake the high-priority traffic and low-priority communica-tions task two categories Design the taskrsquos scheduling func-tion and assure 119862

1is approximately 400 operations and 119862

2is

about 4000 operationsThe program triggers communicationaccording to the different experimental parameters 120582 and119898 to test the influence on wireless sensor performanceThe experiment of the results compares with calculationresults of the method based on queuing theory to verifythe creditability of the method The statistics are shown inTable 3

When the sensor overloaded the sensor network handlesthe task for a long time and the state machine processing hasno support to the sensor network The actual speed of sensorprocessing 120583

119904119903is far less than 120583

119904 When the wireless sensor

network needed specific requirements 119905 of the loss rate andthe sensor throughput it can take the speed of the schedulingto the requirements

For formula (7) it can understand the relationshipbetween the loss rate and the capacity of scheduling It can

easily choose the right sensor in the network which willgreatly improve the quality of service

73 The Methods of Analysis The previous method of finiteautomata has discussed the regular expression matching sys-tem security in WSN and the evaluation of the performanceis ignored to research The matching method in some extentcan maintain the precision and accuracy in some systems itcan be used in a specific environment the performance of theevaluation in the wireless sensor network (WSN) that we hadresearched is in the universal environment it is necessary toconsider the problem of the restrictions such as the capacityof the buffer the length of the queue in the processing timethe performance of the calculation that needs enough bufferfor the task processing and the work conditions In ourresearch the approach which took the matching methodand the evaluating performance together is a new topic Themethod ensures maintaining the system security reducingthe loss rate of the communication task and improving theaccuracy of the scheduleThe universal approach can be used

8 The Scientific World Journal

in lots of environments in the wireless sensor network theapproach has a good excellent performance

8 Conclusions

This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth

The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)

References

[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014

[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002

[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002

[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003

[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011

[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of

the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999

[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011

[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008

[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005

[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011

[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014

[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013

[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012

[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006

[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012

[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008

[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006

[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006

[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007

[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001

[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000

[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational

The Scientific World Journal 9

approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009

[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011

[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009

[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010

Submit your manuscripts athttpwwwhindawicom

Computer Games Technology

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Distributed Sensor Networks

International Journal of

Advances in

FuzzySystems

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014

International Journal of

ReconfigurableComputing

Hindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Applied Computational Intelligence and Soft Computing

thinspAdvancesthinspinthinsp

Artificial Intelligence

HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014

Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Electrical and Computer Engineering

Journal of

Journal of

Computer Networks and Communications

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporation

httpwwwhindawicom Volume 2014

Advances in

Multimedia

International Journal of

Biomedical Imaging

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

ArtificialNeural Systems

Advances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

RoboticsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Computational Intelligence and Neuroscience

Industrial EngineeringJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Human-ComputerInteraction

Advances in

Computer EngineeringAdvances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

6 The Scientific World Journal

Table 1 Experimental parameters setting

Parameter L7-Filter SnortNum of RegExp 161 166Num of DFA states 1432 1257120573 (expression size) 256 256120595 (relevance frequency) [023 034] [023 034]120578 (match probability) [075 099] [075 099]120574 (similarity) [05 10] [05 10]

Take formula (6) into formula (3) the loss rate 119876 is

119876 = 119875lost =1 minus (120582

1198941198622 (119873 minus 120582

1198941198621))

1 minus [1205821198941198622 (119873 minus 120582

1198941198621)]119898+1

times(1205821198941198622)119898

[119873 minus 1205821198941198621]119898

=(1205821198941198622)119898

sum119898

119894=0[119873 minus 120582

1198941198621]119894

(1205821198941198622)119898minus119894

(7)

Formula (7) is the relationship between the loss rate andthe processing capacity It helps to determine the require-ments of the taskrsquos processing

7 Experiment

71 Experiment Set We evaluated our matching approachby regular expression sets extracted from two real-worldsystems named L7-Filter and Snort L7-Filter is famous opensource application layer traffic classier for LinuxThe payloadcontent of a flow and identified its application level protocolare reassembled through regular expression matching Snortis a well-known open-source intrusion detection systemwhich can be configured to performprotocol analysis probesand content inspecting over online traffic by detecting avariety of worms Two sets are chosen as 119877 = 119903

1 1199032 119903

119899

to perform the experiments The experiment parameters ESMP are set as shown in Table 1Then the local optimal valuecan be obtained during our experiments

Print size denotes the memory occupation of prints afterthe profiteering stage Group number is the group number ofcorrelative regular expression according to the parameter 120574Average similarity is the average value of similarity in eachgroup (see (2)) Package size is the testing packages lengthOur simulation environment is based on NS-2 (NetworkSimulator version 2) We set the number of nodes from 20 to100 Number of suspicious package is the number of packagethat needs to be verified after the profiteering stage Lastly wecalculate our experiment efficiency by their average executingcost Efficiency = (Num of suspicious packageTotal packageNumber) times (119865(119892

119894)Group Number)

Table 2 demonstrates that we can get a good efficiencypromotion from 7317 to 8973 A regular matchingcomparison was performed with our strategy and normalapproach The average hop and average 119865(119866

119894) variation

tendency and the number of nodes are shown in Figure 7L7-Filter and Snort were tested separately 119910-axis is hops and119909-axis indicates the nodes number From the results figure

Average hops on L7

010

50

40

30

20

10

20 30 40 50 60 70 80 90

Average hops on Snort

Nodes

10 20 30 40 50 60 70 80 90Nodes

Hops L7Hops L7 Gi

Hop

s

0

50

40

30

20

10

Hop

s

Hops SnortHops Snort Gi

Figure 7 Results of node average hops in NS-2

a significant difference can be observed when nodes aremorethan 30 the hops number of using 119866

119894decreases sharply

Figure 7 demonstrates that the matching approach cantest and verify the packages efficiently when the number ofwireless nodes is more than 30 which indicates that ourapproach can be well adapted to medium or large scaledistributed wireless sensor network On the other hand thereis no major difference in average hops when the system ishandling a small group of wireless nodes Comparing withother end-to-end strategies [9] our approach provides awell scalable way to construct intrusion detection systemby integrating distributed wireless sensor nodes Based onappropriate parameters network attacks can bemonitored byour system in an effective way

72 Experiment of Queue Model The experiment comparestwo groups of the performance results which computed bythe queuing theory and got the results from the softwareNS2 The NS2 platform simulated the STM32W108 sensornetworking we found that it is affected with the followingparameters the average length of stay for communicationtasks the average queue waiting time of tasks the occupancyrate and the task throughput

The Scientific World Journal 7

Table 2 Experimental data

Parameters

Results L7-Filter Snort1205781= 024

1205742= 077

1205951= 06

1205782= 026

1205742= 0831205952= 5

1205783= 036

1205743= 098

1205953= 10

1205781= 024

1205742= 077

1205951= 06

1205782= 026

1205742= 0831205952= 5

1205783= 036

1205743= 098

1205953= 10

Print size 015MB 031MB 012MB 025MB 039MB 024MBGroup number 14 17 11 14 15 12Average similarity 083 098 095 089 089 097Package size 1024 B 2048 B 4096 B 1024 B 2048 B 4096 BNumber of suspiciouspackage 253 83 122 41 114 48

Efficiency 8973 7317 765 831 7794 8535

Table 3 Experimental data statistics

Parameters

Indicator Queuing theory model calculation results NS2 simulation results1205821= 180 120582

2= 270

1205831= 1205832= 700

119898 = 100

1205821= 150 120582

2= 400

1205831= 1205832= 700

119898 = 35

1205821= 180

1205822= 400

119898 = 100

1205821= 150

1205822= 400

119898 = 35

Queue length 120 40 112 38

Average sojourn time(s) 1198821199041= 00019230

1198821199042= 0005385

1198821199041= 00018182

1198821199042= 0008485

1198821199041= 00018240

1198821199042= 0005062

1198821199041= 00016401

1198821199042= 000849

Average waiting time(s) 1198821199021

= 00004945

1198821199022

= 0004956

1198821199021

= 00003924

1198821199022

= 00069565

1198821199021

= 00003982

1198821199022

= 00045412

1198821199021

= 00002116

1198821199022

= 0006783

Wireless sensor usagerate 955 819 966 883

Sensor networkthroughput 436000 474300 453954 423561

Tasks loss rate 270677 0099 377 0098

Simulation software configuration communication taskstake the high-priority traffic and low-priority communica-tions task two categories Design the taskrsquos scheduling func-tion and assure 119862

1is approximately 400 operations and 119862

2is

about 4000 operationsThe program triggers communicationaccording to the different experimental parameters 120582 and119898 to test the influence on wireless sensor performanceThe experiment of the results compares with calculationresults of the method based on queuing theory to verifythe creditability of the method The statistics are shown inTable 3

When the sensor overloaded the sensor network handlesthe task for a long time and the state machine processing hasno support to the sensor network The actual speed of sensorprocessing 120583

119904119903is far less than 120583

119904 When the wireless sensor

network needed specific requirements 119905 of the loss rate andthe sensor throughput it can take the speed of the schedulingto the requirements

For formula (7) it can understand the relationshipbetween the loss rate and the capacity of scheduling It can

easily choose the right sensor in the network which willgreatly improve the quality of service

73 The Methods of Analysis The previous method of finiteautomata has discussed the regular expression matching sys-tem security in WSN and the evaluation of the performanceis ignored to research The matching method in some extentcan maintain the precision and accuracy in some systems itcan be used in a specific environment the performance of theevaluation in the wireless sensor network (WSN) that we hadresearched is in the universal environment it is necessary toconsider the problem of the restrictions such as the capacityof the buffer the length of the queue in the processing timethe performance of the calculation that needs enough bufferfor the task processing and the work conditions In ourresearch the approach which took the matching methodand the evaluating performance together is a new topic Themethod ensures maintaining the system security reducingthe loss rate of the communication task and improving theaccuracy of the scheduleThe universal approach can be used

8 The Scientific World Journal

in lots of environments in the wireless sensor network theapproach has a good excellent performance

8 Conclusions

This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth

The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)

References

[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014

[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002

[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002

[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003

[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011

[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of

the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999

[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011

[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008

[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005

[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011

[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014

[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013

[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012

[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006

[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012

[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008

[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006

[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006

[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007

[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001

[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000

[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational

The Scientific World Journal 9

approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009

[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011

[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009

[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010

Submit your manuscripts athttpwwwhindawicom

Computer Games Technology

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Distributed Sensor Networks

International Journal of

Advances in

FuzzySystems

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014

International Journal of

ReconfigurableComputing

Hindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Applied Computational Intelligence and Soft Computing

thinspAdvancesthinspinthinsp

Artificial Intelligence

HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014

Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Electrical and Computer Engineering

Journal of

Journal of

Computer Networks and Communications

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporation

httpwwwhindawicom Volume 2014

Advances in

Multimedia

International Journal of

Biomedical Imaging

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

ArtificialNeural Systems

Advances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

RoboticsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Computational Intelligence and Neuroscience

Industrial EngineeringJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Human-ComputerInteraction

Advances in

Computer EngineeringAdvances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World Journal 7

Table 2 Experimental data

Parameters

Results L7-Filter Snort1205781= 024

1205742= 077

1205951= 06

1205782= 026

1205742= 0831205952= 5

1205783= 036

1205743= 098

1205953= 10

1205781= 024

1205742= 077

1205951= 06

1205782= 026

1205742= 0831205952= 5

1205783= 036

1205743= 098

1205953= 10

Print size 015MB 031MB 012MB 025MB 039MB 024MBGroup number 14 17 11 14 15 12Average similarity 083 098 095 089 089 097Package size 1024 B 2048 B 4096 B 1024 B 2048 B 4096 BNumber of suspiciouspackage 253 83 122 41 114 48

Efficiency 8973 7317 765 831 7794 8535

Table 3 Experimental data statistics

Parameters

Indicator Queuing theory model calculation results NS2 simulation results1205821= 180 120582

2= 270

1205831= 1205832= 700

119898 = 100

1205821= 150 120582

2= 400

1205831= 1205832= 700

119898 = 35

1205821= 180

1205822= 400

119898 = 100

1205821= 150

1205822= 400

119898 = 35

Queue length 120 40 112 38

Average sojourn time(s) 1198821199041= 00019230

1198821199042= 0005385

1198821199041= 00018182

1198821199042= 0008485

1198821199041= 00018240

1198821199042= 0005062

1198821199041= 00016401

1198821199042= 000849

Average waiting time(s) 1198821199021

= 00004945

1198821199022

= 0004956

1198821199021

= 00003924

1198821199022

= 00069565

1198821199021

= 00003982

1198821199022

= 00045412

1198821199021

= 00002116

1198821199022

= 0006783

Wireless sensor usagerate 955 819 966 883

Sensor networkthroughput 436000 474300 453954 423561

Tasks loss rate 270677 0099 377 0098

Simulation software configuration communication taskstake the high-priority traffic and low-priority communica-tions task two categories Design the taskrsquos scheduling func-tion and assure 119862

1is approximately 400 operations and 119862

2is

about 4000 operationsThe program triggers communicationaccording to the different experimental parameters 120582 and119898 to test the influence on wireless sensor performanceThe experiment of the results compares with calculationresults of the method based on queuing theory to verifythe creditability of the method The statistics are shown inTable 3

When the sensor overloaded the sensor network handlesthe task for a long time and the state machine processing hasno support to the sensor network The actual speed of sensorprocessing 120583

119904119903is far less than 120583

119904 When the wireless sensor

network needed specific requirements 119905 of the loss rate andthe sensor throughput it can take the speed of the schedulingto the requirements

For formula (7) it can understand the relationshipbetween the loss rate and the capacity of scheduling It can

easily choose the right sensor in the network which willgreatly improve the quality of service

73 The Methods of Analysis The previous method of finiteautomata has discussed the regular expression matching sys-tem security in WSN and the evaluation of the performanceis ignored to research The matching method in some extentcan maintain the precision and accuracy in some systems itcan be used in a specific environment the performance of theevaluation in the wireless sensor network (WSN) that we hadresearched is in the universal environment it is necessary toconsider the problem of the restrictions such as the capacityof the buffer the length of the queue in the processing timethe performance of the calculation that needs enough bufferfor the task processing and the work conditions In ourresearch the approach which took the matching methodand the evaluating performance together is a new topic Themethod ensures maintaining the system security reducingthe loss rate of the communication task and improving theaccuracy of the scheduleThe universal approach can be used

8 The Scientific World Journal

in lots of environments in the wireless sensor network theapproach has a good excellent performance

8 Conclusions

This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth

The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)

References

[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014

[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002

[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002

[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003

[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011

[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of

the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999

[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011

[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008

[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005

[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011

[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014

[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013

[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012

[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006

[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012

[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008

[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006

[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006

[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007

[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001

[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000

[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational

The Scientific World Journal 9

approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009

[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011

[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009

[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010

Submit your manuscripts athttpwwwhindawicom

Computer Games Technology

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Distributed Sensor Networks

International Journal of

Advances in

FuzzySystems

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014

International Journal of

ReconfigurableComputing

Hindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Applied Computational Intelligence and Soft Computing

thinspAdvancesthinspinthinsp

Artificial Intelligence

HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014

Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Electrical and Computer Engineering

Journal of

Journal of

Computer Networks and Communications

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporation

httpwwwhindawicom Volume 2014

Advances in

Multimedia

International Journal of

Biomedical Imaging

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

ArtificialNeural Systems

Advances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

RoboticsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Computational Intelligence and Neuroscience

Industrial EngineeringJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Human-ComputerInteraction

Advances in

Computer EngineeringAdvances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

8 The Scientific World Journal

in lots of environments in the wireless sensor network theapproach has a good excellent performance

8 Conclusions

This paper presented a regular expressionmatching approachfor the wireless sensor network security systems which isproposed to take the advantage of sensor nodes collabora-tively which divides the matching into matching prepro-cessing phase validation phase and performance evaluationphaseThismethod is based on queuingmodel to evaluate theperformance of scheduling for the wireless sensor networkThe experimental results show that our approach can speedup the efficiency of regular expression by at least 71 for theregular expression set by Snort and L7-Filter systems Andthe queue model helps to obtain the communication tasksprobability distribution and the relation between the taskrsquosprocessing capability and the taskrsquos response time sensorthroughput and so forth

The future work will focus on the following two aspectsthe work will also extend the proposed approach and exploreits feasibility for other network areas and continue to improvethe queuingmodel tomake it closer to the real wireless sensorwhich will raise the accuracy of the model

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This research is supported by the National Natural ScienceFunds of China (no 61472100 and no 61402078) and theFundamental Research Funds for the Central Universities(no DUT14QY32 and no DUT14RC(3)090)

References

[1] R Matam and S Tripathy ldquoProvably secure routing protocolfor wireless mesh networksrdquo International Journal of NetworkSecurity vol 16 no 3 pp 182ndash192 2014

[2] H DengW Li and D P Agrawal ldquoRouting security in wirelessad hoc networksrdquo IEEE Communications Magazine vol 40 no10 pp 70ndash75 2002

[3] L Eschenauer and V D Gligor ldquoA key-management schemefor distributed sensor networksrdquo in Proceedings of the 9th ACMConference on Computer and Communications Security pp 41ndash47 Dalian China November 2002

[4] Y-C Hu D B Johnson and A Perrig ldquoSEAD secure efficientdistance vector routing for mobile wireless ad hoc networksrdquoAd Hoc Networks vol 1 no 1 pp 175ndash192 2003

[5] S S Ahmeda ldquoID-based and threshold security scheme forad hoc networkrdquo in Proceedings of the IEEE 3rd InternationalConference on Communication Software and Networks (ICCSNrsquo11) pp 16ndash21 Xirsquoan China May 2011

[6] M Roesch and Stanford Telecommunications ldquoSnortlightweight intrusion detection for networksrdquo in Proceedings of

the 13th USENIX Conference on System Administration (LISArsquo99) vol 99 pp 229ndash238 1999

[7] A Prathapani L Santhanam and D P Agrawal ldquoDetection ofblackhole attack in a wireless mesh network using intelligenthoneypot agentsrdquo Journal of Supercomputing vol 64 no 3 pp777ndash804 2011

[8] J Levandoski E Sommer M Strait et al ldquoApplication layerpacket classifier for linuxrdquo 2008

[9] X Li M Chen and W Liu ldquoApplication of STBCmdashencodedcooperative transmissions in wireless sensor networksrdquo IEEESignal Processing Letters vol 12 no 2 pp 134ndash137 2005

[10] K Kim ldquo(Nn)-preemptive priority queuesrdquo Performance Eval-uation vol 68 no 7 pp 575ndash585 2011

[11] J Wang Y Yanshuo and K Zhou ldquoA regular expressionmatching approach to distributed wireless network securitysystemrdquo International Journal of Network Security vol 16 no5 pp 382ndash388 2014

[12] W Jie K Zhou K Cui et al ldquoEvaluation of the task communi-cation performance in wireless sensor networks a queue theoryapproachrdquo inGreen Computing and Communications IEEE andInternet of Things IEEE International Conference on and IEEECyber Physical and Social Computing pp 939ndash944 IEEE 2013

[13] J P A X Liu and E Torng ldquoBypassing space explosion inregular expression matching for networkintrusion detectionand prevention systemsrdquo 2012

[14] S Kumar S Dharmapurikar F Yu P Crowley and J TurnerldquoAlgorithms to accelerate multipleregular expressions matchingfor deep packet inspectionrdquo ACM SIGCOMM Computer Com-munication Review vol 36 no 4 pp 339ndash350 2006

[15] T Liu Y Sun A X Liu L Guo and B Fang ldquoA prelteringapproach to regular expression matching for network securitysystemsrdquo in Applied Cryptography and Network Security pp363ndash380 Springer Berlin Germany 2012

[16] M Becchi and P Crowley ldquoEfficient regular expression evalu-ation Theory to practicerdquo in Proceeding of the 4th ACMIEEESymposium on Architectures for Networking and Communica-tions Systems (ANCS 08) pp 50ndash59 New York NY USANovember 2008

[17] S Kumar J Turner and J Williams ldquoAdvanced algorithms forfast and scalable deep packet inspectionrdquo in Proceedings of the2nd ACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo06) pp 81ndash92 ACM NewYork NY USA December 2006

[18] B C Brodle R K Cytron and D E Taylor ldquoA scalablearchitecture for high-throughput regular-expression patternmatchingrdquo in Proceedings of the 33rd International SymposiumonComputer Architecture (ISCA 06) pp 191ndash202 BostonMassUSA June 2006

[19] A Mitra W Najjar and L Bhuyan ldquoCompiling PCRE toFPGA for accelerating SNORT IDSrdquo in Proceedings of the 3rdACMIEEE Symposium on Architectures for Networking andCommunications Systems (ANCS rsquo07) pp 127ndash135 ACM NewYork NY USA December 2007

[20] R Sidhu and V K Prasanna ldquoFast regular expression matchingusing fpgasrdquo in Proceedings of the 9th Annual IEEE Symposiumon Field-Programmable Custom Computing Machines (FCCMrsquo01) pp 227ndash238 IEEE 2001

[21] L Chuan-Lai The Queuing Theory Beijing University of Postsand Telecommunications Press Beijing China 2000

[22] S SMishra andD K Yadav ldquoCost and profit analysis ofMarko-vian queuing system with two priority classes a computational

The Scientific World Journal 9

approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009

[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011

[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009

[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010

Submit your manuscripts athttpwwwhindawicom

Computer Games Technology

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Distributed Sensor Networks

International Journal of

Advances in

FuzzySystems

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014

International Journal of

ReconfigurableComputing

Hindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Applied Computational Intelligence and Soft Computing

thinspAdvancesthinspinthinsp

Artificial Intelligence

HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014

Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Electrical and Computer Engineering

Journal of

Journal of

Computer Networks and Communications

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporation

httpwwwhindawicom Volume 2014

Advances in

Multimedia

International Journal of

Biomedical Imaging

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

ArtificialNeural Systems

Advances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

RoboticsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Computational Intelligence and Neuroscience

Industrial EngineeringJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Human-ComputerInteraction

Advances in

Computer EngineeringAdvances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World Journal 9

approachrdquo International Journal of Applied Mathematics andComputer Sciences vol 5 no 3 pp 150ndash156 2009

[23] V Srinivas S S Rao and B K Kale ldquoEstimation of measuresin MM1 queuerdquo Communications in StatisticsmdashTheory andMethods vol 40 no 18 pp 3327ndash3336 2011

[24] W F Nasrallah ldquoHow pre-emptive priority affects completionrate in an MM1 queue with Poisson renegingrdquo EuropeanJournal of Operational Research vol 193 no 1 pp 317ndash320 2009

[25] A Al Hanbali and O Boxma ldquoBusy period analysis of the statedependent1198721198721119870 queuerdquo Operations Research Letters vol38 no 1 pp 1ndash6 2010

Submit your manuscripts athttpwwwhindawicom

Computer Games Technology

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Distributed Sensor Networks

International Journal of

Advances in

FuzzySystems

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014

International Journal of

ReconfigurableComputing

Hindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Applied Computational Intelligence and Soft Computing

thinspAdvancesthinspinthinsp

Artificial Intelligence

HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014

Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Electrical and Computer Engineering

Journal of

Journal of

Computer Networks and Communications

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporation

httpwwwhindawicom Volume 2014

Advances in

Multimedia

International Journal of

Biomedical Imaging

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

ArtificialNeural Systems

Advances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

RoboticsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Computational Intelligence and Neuroscience

Industrial EngineeringJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Human-ComputerInteraction

Advances in

Computer EngineeringAdvances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Submit your manuscripts athttpwwwhindawicom

Computer Games Technology

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Distributed Sensor Networks

International Journal of

Advances in

FuzzySystems

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014

International Journal of

ReconfigurableComputing

Hindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Applied Computational Intelligence and Soft Computing

thinspAdvancesthinspinthinsp

Artificial Intelligence

HindawithinspPublishingthinspCorporationhttpwwwhindawicom Volumethinsp2014

Advances inSoftware EngineeringHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Electrical and Computer Engineering

Journal of

Journal of

Computer Networks and Communications

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporation

httpwwwhindawicom Volume 2014

Advances in

Multimedia

International Journal of

Biomedical Imaging

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

ArtificialNeural Systems

Advances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

RoboticsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Computational Intelligence and Neuroscience

Industrial EngineeringJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Modelling amp Simulation in EngineeringHindawi Publishing Corporation httpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Human-ComputerInteraction

Advances in

Computer EngineeringAdvances in

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014