论文部分内容阅读
网络入侵检测依赖于字符串匹配技术.尽管各种有效的字符串匹配技术不断被使用,但字符串匹配过程的消耗仍是入侵监测系统运行的主要系统开销.为了提高入侵监测系统的运行效率和运算能力,提出并设计了新的字符串匹配算法(NM SA).算法采用新的匹配思想,应用启发函数获得优于BM移动步长的新的跳跃,同时采用有限状态模式匹配自动机可同时进行多模式匹配.将算法应用于Snort系统,并和其他算法进行比较,实验证明NM SA整体上提高了系统的效率.
Network intrusion detection relies on string matching technology.While a variety of effective string matching techniques continue to be used, but the consumption of string matching process is still the main system overhead of intrusion detection system.In order to improve the operation efficiency of intrusion detection system and Computing ability, a new string matching algorithm (NM SA) is proposed and designed.A new matching idea is used to obtain new jumps which are better than the BM moving steps by using the heuristic function, while the finite state pattern matching automaton The algorithm is applied to the Snort system and compared with other algorithms. The experiment proves that the NM SA improves the system efficiency as a whole.