摘要
针对网络入侵检测系统的一般问题,在详细分析现存单模式与多模式匹配算法的基础上,将AC算法里的DFSA方法与单模式匹配算法BMH的思想相融合,以求取优化检测效率为目标,提出一种基于确定有限状态自动机的改进多模式匹配算法。该算法特别适合在大字符集文本串中查找小字符集模式串。将该改进多模式匹配算法应用到Snort入侵检测过程中,针对处理结果进行科学评价。通过实例的应用,验证了该改进算法的可行性和高效性。
Aiming at the general problems of network intrusion detection system, we make the thorough analysis on existing single pattern and multi-patteru matching algorithms. On this basis, we integrate the DFSA method in AC algorithm with the idea of BMH in single pattern matching algorithm, and take it as the goal that to seek the optimised detection efficiency, we present an improved multi-pattern matching algorithm which is based on deterministic finite-state automaton. This algorithm is particularly suitable for finding the small character sets pattern string in large character set text string. We apply this improved multi-pattern matching algorithm in Snort network intrusion detection process, and make scientific evaluation on the treatment results. Through applying it in practical example, the feasibility and efficiency of the improved algorithm is verified.
出处
《计算机应用与软件》
CSCD
北大核心
2013年第7期321-323,330,共4页
Computer Applications and Software
关键词
网络入侵检测系统
模式匹配
单模式
确定有限状态自动机
优化策略
Network intrusion detection system Pattern matching Single pattern Deterministic finite-state automaton Optimised strategy
