The Research Of The BMHS2 Algorithm And Its Application In IDS

The process of pattern-matching is one of the biggest consumptive segments in running time and memory space, it needs for a efficient pattern matching algorithm as a guarantee. Therefore, Pattern matching algorithm has a direct impact on detective performance, this study focuses on the research and improvement of pattern matching algorithm, which is used in the intrusion detection.Emphasis on the single-mode matching, such as BF, KMP, BM, BMH, BMHS and other algorithms, carried on the detailed analysis and the discussion from the principle to the performance in those algorithms. Proposed a new pattern matching algorithm named BMHS2 based on BMH and BMHS. Compared the algorithms before, it makes the improvement in the skipping maximum range when the jump in its course does not match. Our analysis found that, it can jump through a combination of two characters to speed up the matching. The theoretical analysis indicates its may skips the maximum distance when does not match, the experiment tests the confirmation comparison number of times to compare the BM algorithm to have the distinct enhancement, the time behavior also surpasses the BM algorithm.Applies the BMHS2 algorithm in the Snort system, then has carried on the analysis and the confirmation to BMHS2 algorithm's each target. Compares in an actual net boundary tests Snort, using the BM algorithm and the BMHS2 algorithm performance experiment indicated that obtains the analysis result in the same rules set situation to be the same, which indicates that the same behavior of the two algorithms; and BMHS2 comparison of algorithms BM algorithm can be effectively improve the system, the detection rate of 10% to 20%, the memory space compares BM the algorithm slightly to have the rise.