用于网络入侵检测的模式匹配新方法  

New method of pattern-matching for network intrusion detection

作　　者：樊爱京[1] 杨照峰[2] 

机构地区：[1]平顶山学院网络计算中心,河南平顶山467002 [2]平顶山学院软件学院,河南平顶山467002

出　　处：《计算机应用》2011年第11期2961-2964,2985,共5页journal of Computer Applications

摘　　要：针对新一代网络入侵检测系统(NIDS)的创建需要先进的模式匹配引擎,提出一种模式匹配的新方案,利用基于硬件的可编程状态机技术(B-FSM)来实现确定性处理过程。该技术可以在一个输入流中同时获取大量模式,并高效地映射成转换规则。通过对网络入侵检测系统中普遍采用的规则集(Snort)进行实验,实验结果表明该方法具有存储高效、执行速度快、动态可更新等特点,可以满足NIDS的需要。New generations of Network Intrusion Detection Systems（NIDS） create the need for advanced pattern-matching engines.This paper presented a new scheme for pattern-matching,which adopted a hardware-based programmable state machine technology to achieve deterministic processing rates.A lot of patterns can be obtained in one input stream by Balanced Routing Table-based FSM（B-FSM）,and transition rules can be mapped effectively.Experiments had been done with Snort used widely in network intrusion detection systems.The experimental results show that the method is effective in storage,fast in operation,and renewable dynamically.The method proposed in this paper can satisfy the requirement of NIDS.

关 键 词：网络入侵检测系统 可编程状态机 模式匹配 转换规则 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]