基于否定匹配的报文内容检测方法研究  

Message Content Detection Method Research Based on Negative Pattern

作　　者：龚德良[1] 章才能[1] 段思婧 李煜民[1] 

机构地区：[1]湘南学院软件与通信工程学院,郴州423000

出　　处：《计算机与数字工程》2015年第10期1834-1837,1864,共5页Computer & Digital Engineering

基　　金：教育部"本科教学工程"地方高校第一批本科专业综合改革试点项目(教高司函〔2013〕56号;项目编号:ZG0388);湖南省自然科学基金项目(编号:2jj3069)资助

摘　　要：传统的网络入侵检测方法虽然可以检测到包含入侵信号的数据报文,但是检测速度和效率都难以适应高速的网络环境。论文应用否定匹配方法优化网络入侵检测中传统检测算法,设计了基于否定匹配的内容过滤算法,先对报文进行分段,然后过滤报文段内容中不含入侵信号的正常报文,再对怀疑含有入侵信号的报文段进行详细检测,提高了检测匹配速度和效率。Traditional network intrusion detection method can be used to check the data message containing the intrusion signal,but the detection speed and efficiency are difficult to adapt high speed network environment.Negative pattern method is used to optimize the traditional detection algorithm in network intrusion detection,the content filter algorithm is designed based on negative pattern.Firstly,the message is divided into segment,and then the normal message segment which does not contain the intrusion signal is filtered,the message segment which is suspected containing intrusion signal is checked in detail to improve the detection matching speed and efficiency.

关 键 词：否定匹配 模式匹配 内容分段 匹配次数 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]