用于入侵检测的快速多模式匹配算法  

A Fast Multiple Pattern Matching Using in Intrusion Detection

作　　者：辛阳[1] 魏景芝[1] 钮心忻[1] 顾阳[1] 

机构地区：[1]北京邮电大学网络与交换技术国家重点实验室,北京100876

出　　处：《北京邮电大学学报》2008年第3期19-23,共5页Journal of Beijing University of Posts and Telecommunications

基　　金：国家"973计划"项目(2007CB310704)

摘　　要：针对目前入侵检测匹配算法速率过慢的问题,提出了一种快速多模式匹配算法.一般情况下,该算法能充分利用匹配过程中本次匹配不成功的信息和已经匹配成功的信息,尽可能多地跳过待查文本串中的字符,不需要匹配目标文本串的每个字符,就能一次性实现对文本的快速搜索.此外,该算法由于采用组合状态自动机,还能对中文进行快速搜索.实验结果表明,该算法相比目前其他算法具有更高的检测效率,并能有效地降低系统的丢包率.For the weakness of low string matching speed in intrusion detection field, a fast improved algorithm to perform multiple pattern matching in a string was presented. In general, the algorithm described does not need to test each character in the string. By making full use of the results of matching successes and failures, the algorithm can often bypass inspection of as many characters as possible and get all matching locations after one quick search. Secondly, the new algorithm can match Chinese string due to using a combinatorial state automaton. Experimental results demonstrate that the proposed algorithm achieves excellent performance of detection and is helpful to reduce systematical missing package rate.

关 键 词：多模式串匹配 有限自动机 关键字检测过滤 入侵检测 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]