多模匹配问题在IDS中的解决  

Solution of Multi-pattern Matching Problem in IDS

作　　者：鲁鹏俊[1] 钟亦平[1] 张世永[1] 

机构地区：[1]复旦大学计算机信息与工程系,上海200433

出　　处：《计算机工程》2005年第4期146-147,151,共3页Computer Engineering

摘　　要：传统的Snort系统引入单模式匹配速度较快的BM算法进行特定的模式匹配。文献[1]在Snort系统中引入了基于KMP的多模式匹配算法,能有效地提高系统的性能。但是该匹配算法本身存在着局限性,以致于无法完成含有多Content属性选项规则的匹配工作。该文从 多content属性选项的规则匹配问题着手,提出了解决方案,从而进一步推进了多模式匹配算法在IDS中的引入。Traditional Snort system introduces high speed single-pattern matching BM algorithm for specific pattern matching, while document [1] introduces a multi-pattern matching algorithm based on KMP, by which the systematic performance of Snort can be effectively improved. However the algorithm has its limitations too. It is unable to implement the matching work while a rule contains multiple properties. This article aims at the very point mentioned above and gives an effective solution, which largely accelerates the introduction of multi-pattern matching technology in IDS.

关 键 词：入侵检测 多模式匹配 状态树 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]