摘要
基于特征的网络入侵检测系统性能与其所采用的匹配算法息息相关。本文对当前入侵检测系统中几种典型的匹配算法进行了分析,并指出了这些算法在入侵检测系统应用中存在的不足,同时,给出了完整的基于AC自动机匹配算法的入侵检测系统方案,理论分析和实验结果表明该系统能够实施快速高效的入侵检测。
The performance of signature-based network intrusion detection systems(NIDS) is dominated by the string matching of packets against many signatures. In this paper, we analyze the performance of current string matching algorithms, they are Brute-Force, Knuth-Morris-Pratt, and Boyer-Moore. And we point out the disadvantages of them when used in actual NIDS. Meanwhile we introduce an alternative algorithm based on Aho-Corasick Automaton which is proven theoretically and practically more efficient.
出处
《微电子学与计算机》
CSCD
北大核心
2005年第3期89-92,95,共5页
Microelectronics & Computer
