Snort中BM模式匹配算法的研究与改进

Research and improvement of BM-algorithm for pattern matching in Snort

随着网络安全问题的日益严峻,入侵检测系统Snort凭借其自身特点能有效地弥补传统安全保护措施的不足,己成为计算机与网络安全的重要组成部分。模式匹配算法是基于特征匹配入侵检测系统中的核心算法,模式匹配的效率决定这类入侵检测系统的性能。文章首先详细阐述了入侵检测系统Snort的BM模式匹配算法思想,在此基础上提出了一种改进的BM算法,该算法在重复后缀较多的情况下,能有效加快模式匹配的速度,提高入侵检测的效率。

With increasingly serious security problem, Snort Intnusion Detection System, with its own characteristics to make up for effective security measures to protect the traditional shortcomings of computers and networks has become an important part of security. Pattern matching algorithm is based on the characteristics of the intrusion detection system to match the core algorithm, the eifficieney of pattern matehing intrusion detection system such performance. First of all, the detail of the Snort Intrusion Detection System BM pattern rnatehing algorithm, on the basis of an improved BM algorithm repeated suffix circumstances more effectively to accelerate the speed of pattern matehing in order to improve the efficiency of intrusion detection.