The Application And Research Of Multi Pattern Matching Algorithm In UTM Gateway

With the rapid development of Internet, the pressure and threat from networksecurity issues are becoming more serious. The firewall technique is an efficientmethod for keeping the network information safe. However, the traditional firewallsystem can not filter the content of network information effectively, and becomeeasily the bottleneck of the entire network performance. Therefore, how to improvethe efficiency of content filtering has become a hot research field in informationsecurity. As one of the core technologies of the firewall system, improving thepattern matching technology can make the firewall system more effective.The research status of the firewall system is described in this thesis. Contentfiltering mechanisms, the advantages and disadvantages of the packet filter firewalland application layer firewall is researched. The technical features of UTMgateway is described in detail. The classic single matching algorithms——BF,KMP, BM is introduced，and multi pattern matching algorithms——AC, AC-BM isintroduced too.AC-BM algorithm is widely recognized as an efficient multi pattern matchingalgorithm. But because of the feature of the AC-BM algorithm, the maximumjumping length and average jumping length are short. A new multi-patternmatching algorithm——AC-PCJ algorithm is proposed which is based on theshortage of AC-BM algorithm. The algorithm calculates the real jumping length bypre-character and bad-character rules. AC-PCJ algorithm, which is more effective,can increase the maximum jumping length from L to L+1. And the average jumpinglength is improved. The efficiency of the algorithm is tested by experiments.The UTM gateway system, which is based on Linux/Netfilter framework, isdesigned by the structural feature of UTM. The core algorithm of virus filteringmodule uses the AC-PCJ algorithm. The testing environment is set up. Theperformance and efficiency of virus filtering module is tested in UTM system. Thetest results show that the UTM system not only can filter viruses, but also has ahigh efficiency.