Network Intrusion Detection Pattern Matching Algorithms

With the prevalent of network application,network attack,illegal access and computer virus increase day by day.The problem of network security is more and more serious. As an active and real-time security protection system,network instrusion detection system becomes the new generation of the security technology after the traditional security protection method,such as firewall,the data encryption and so on. Patten matching algorithms is a core technology of the rule-based instrusion detection system.lt directly influences the accuracy and real-time performance of the system and enen decides the capability of the system.This paper works over the present development situation of network security and instrusion detection technology,then deeply studies on the pattern matching algorithms used in the instrusion detection system,including the the classical BF, KMP and BM single pattern matching algorithm, as well as AC and AC-BM multi-pattern matching algorithms.Because of the defect of AC-BM algorithm,this paper presents an improved AC-BM algorithm.Combining the thought of BMH and BMHS algorithm,the improved AC-BM algorithm gives up the good-prefix rule and only uses of the bad-character rule,then improves the bad-character rule to increase the jump distance of patter matching.The same time,fuse the thought of bi-directinal scanning of LMD algorithm into the improved AC-BM algorithm, it greatly improves mathing efficiency throught reducing the times of character matching when most prefix mathing and only very few suffix not matching to the patter.According to the principle of the improved algorithm,using c++ to realize,test the performance of the algorithm and compare with original algorithm on efficiency.The experimental results show that the improved algorithm effectively improves the speed of the pattern matching.So the improved AC-BM algorithm has a very good value of application.Finally,the conclusion is made on the main content of this paper,and the trend of development of instusion detection system is outlooked.