一种改进的Boyer-Moore算法在IDS中的应用  

Improved Boyer-Moore Algorithm Applied in IDS

作　　者：王淅娜 喻建鹏 

机构地区：[1]解放军后勤学院研究生2队,北京100858 [2]海军装备部,北京100841

出　　处：《计算机科学》2013年第11A期196-198,218,共4页Computer Science

摘　　要：在IDS的检测引擎模块设计中,基于Pattern-Matching的误用检测算法是设计师们最常用到的一种核心技术实现途径,而IDS丢包率和误报率的高低以及检测引擎匹配速度的快慢都取决于模式匹配算法性能的好与坏。Boyer-Moore算法及其改进了的Boyer-Moore Horspool算法和Boyer-Moore HorspoolS算法是目前应用最广泛的单模式匹配算法。在分析了BM算法及各种改进算法的基础上提出了一种新的基于BM算法的改进算法。该算法利用了字符串末字符和末字符对应文本串的下一字符的唯一性,同时考虑了文本串的信息以加大匹配速率,从而更好地适应IDS对模式匹配算法高效性的要求。In module design for detection engine of IDS, the misuse of detection based on the Pattern Matching algorithm is the most commonly used by designers as a means of core technology, and the loss rate of data packet, the rate of false positives of IDS and Matching speed of detection engine depend on the performance of Pattern Matching algorithm. Boyer-Moore algorithm, its improved Boyer-Moore Horspool algorithm and Boyer Moore Horspool System algorithm are the the most used-widely Pattern Matching algorithm. Based on the analysis of the BM algorithm and im- proved algorithm, a new improved BM algorithm is proposed in the article. The algorithm takes advantage of the end character of the string and the uniqueness of next character of corresponding text strings in it, and consider the text string information to increase Matching speed, so that can accommodate to the requirement of high-efficiency of Pattern Matching algorithm for IDS.

关 键 词：入侵检测 BM算法 模式匹配 SNORT KMP算法 

分 类 号：TP301.6[自动化与计算机技术—计算机系统结构]