改进Boyer匹配算法在Snort入侵检测中的应用  

Application of Improved Boyer Matching Algorithm in Snort Intrusion Detection

作　　者：马小雨[1] 刘双红[2] 

机构地区：[1]河南工程学院计算机学院,河南郑州451191 [2]郑州航空工业管理学院计算机科学与应用系,河南郑州450046

出　　处：《华侨大学学报（自然科学版）》2016年第2期168-170,共3页Journal of Huaqiao University(Natural Science)

基　　金：河南省科技厅科研项目(102102310261)

摘　　要：以Snort入侵检测系统为研究对象,探讨其规则匹配环节的适用算法,并在Boyer算法的基础上设计一种改进方法.此方法首先设计了一个统计数组,然后以两个相邻字符为组合执行匹配,并分为3种策略判断如何确定最大移动长度.实验结果表明:这种改进措施,使得最大移动长度更加合理,相比于Boyer方法,改进方法的字符比较次数明显降低,窗口移动次数明显降低,执行时间明显减少.In this paper,the application of Snort intrusion detection system is studied.An improved method based on Boyer algorithm is designed.This method first designs a statistical array,then executes the matching with two adjacent characters,and divides into three strategies to determine the maximum movement length.Experimental results show this improvement makes the maximum movement length more reasonable.Compared with the Boyer method,the proposed method is significantly lower than the number of characters method,the number of windows mobile number is significantly reduced,the execution time is significantly reduced.

关 键 词：网络安全 入侵检测 SNORT系统 Boyer算法 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]