一种构造入侵检测系统模式匹配自动机的方法

Constructing Pattern-Matching Automaton for Intrusion Detection System

介绍了一种新的用于构造入侵检测系统模式匹配自动机的方法,该方法的基本出发点在于NFA与DFA能力的等价性、构造NFA的方便性和DFA运行的高效性。它从构造判定单个模式的NFA自动机入手,通过集成单个的NFA而得到全集的NFA,并将全集NFA转换为与之等价的DFA并化简,从而可得到全集的确定型模式匹配有限自动机。由于该方法可以完全自动完成,从而可方便地为入侵检测系统构造模式匹配自动机。

A new method, which can be used in constructing pattern matching automaton for intrusion detection system is proposed in this paper. The key point of this method is the equivalence of NFA and DFA, the convenience of constructing NFD, and efficiency of DFA. By starting from constructing single pattern matching NFA for every single pattern, then integrating the all constructed NFA into full - pattern NFA, converting the full - pattern NFA into its equivalent DFA, and simplifying the DFA, a DFA served as an engine for intrusion detection system can be constructed.