面向入侵检测的改进BM模式匹配算法

Improved Pattern Matching Algorithm of BM for Intrusion Detection

网络入侵检测系统的效率取决于模式匹配算法选择。分析了目前网络上常用的BM算法及其不足,提出了一种更高效的改进算法。该算法利用模式串自身的特点,能有效地减少字符重复比较的次数,并利用位置移动表代替BM算法中的好后缀和坏字符移动表,提高了算法的匹配效率。实验结果表明,改进的模式匹配算法能够有效提高网络入侵检测系统的检测速度。

The performance efficiency of a network intrusion detection system（NIDS） is dominated by pattern matching algorithm.On the basis of analyzing the most popular BM algorithm,an improved algorithm based on BM algorithm,N-BM algorithm,is presented.The algorithm uses the characteristic of pattern strings to decrease the times of comparing and improve the efficiency of the pattern matching by using the position shift replaces Good-Suffix-Shift and Bad-Character-Shift.In the end,the result of the experiment shows that this algorithm is able to accelerate the detecting velocity of NDIS.