入侵检测系统中模式匹配算法的研究与改进  

Research and Improvement of Pattern Matching Algorithm for Intrusion Detection System

作　　者：陶善旗[1] 李俊[1] 郭伟群[1] 李海龙[1] 

机构地区：[1]南京航空航天大学信息科学与技术学院,江苏南京210016

出　　处：《计算机技术与发展》2010年第2期167-170,174,共5页Computer Technology and Development

基　　金：国防科工委国防基础科研项目(S0500B003)

摘　　要：入侵检测系统的性能很大程度上取决于规则检测的效率,模式匹配算法是规则检测引擎的核心算法。对模式匹配算法进行了研究,重点分析了多模式匹配算法Wu-Manber算法。针对Wu-Manber算法在单字节模式串下移动距离短的不足,并结合网络数据包和入侵检测系统中规则的特点,提出了一种适合入侵检测系统的改进的模式匹配算法。该算法利用位示图方法解决了单字节模式串匹配的问题,增加了移动距离,提高了检测数据包与规则匹配的速度,提升了系统运行的效率。Performance of the intrusion detection system is determined by efficiency of rule detection. Pattern matching algorithm is one of the core algorithms in the detection engine. A research of the pattern matching algorithm is described in this thesis. For the lack of Wu- Manber algorithm＇s move distance in single - byte pattern situation, and the features of network packets and characteristics of IDS, presented an improvement of the Wu - Manber algorithm which suitable for IDS. The improvement algorithm solves the problem of string match in single- byte pattern situation using bitmap, increases the distance of move,speeds the detection of packets,improves the efficiency.

关 键 词：入侵检测系统 模式匹配 Wu—Manber算法 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]