基于确定有限状态自动机的改进多模式匹配算法研究  

RESEARCH ON IMPROVING MULTI-PATTERN MATCHING ALGORITHM BASED ON DETERMINISTIC FINITE-STATE AUTOMATON

作　　者：陆琳琳[1] 田野[2] 

机构地区：[1]大连外国语学院软件学院,辽宁大连116044 [2]长春理工大学计算机科学与技术学院,吉林长春130022

出　　处：《计算机应用与软件》2013年第7期321-323,330,共4页Computer Applications and Software

摘　　要：针对网络入侵检测系统的一般问题,在详细分析现存单模式与多模式匹配算法的基础上,将AC算法里的DFSA方法与单模式匹配算法BMH的思想相融合,以求取优化检测效率为目标,提出一种基于确定有限状态自动机的改进多模式匹配算法。该算法特别适合在大字符集文本串中查找小字符集模式串。将该改进多模式匹配算法应用到Snort入侵检测过程中,针对处理结果进行科学评价。通过实例的应用,验证了该改进算法的可行性和高效性。Aiming at the general problems of network intrusion detection system, we make the thorough analysis on existing single pattern and multi-patteru matching algorithms. On this basis, we integrate the DFSA method in AC algorithm with the idea of BMH in single pattern matching algorithm, and take it as the goal that to seek the optimised detection efficiency, we present an improved multi-pattern matching algorithm which is based on deterministic finite-state automaton. This algorithm is particularly suitable for finding the small character sets pattern string in large character set text string. We apply this improved multi-pattern matching algorithm in Snort network intrusion detection process, and make scientific evaluation on the treatment results. Through applying it in practical example, the feasibility and efficiency of the improved algorithm is verified.

关 键 词：网络入侵检测系统 模式匹配 单模式 确定有限状态自动机 优化策略 

分 类 号：TP301[自动化与计算机技术—计算机系统结构]