【摘要】 针对入侵检测系统对基于攻击特征的网络数据包的检测效率低和丢包率高的问题,在分析典型的模式匹配算法的基础上,提出了一种Boyer Moor Horspool Fast(BMHF)匹配算法.引入一个新的判断函数Q(X)指出字符X在模式串中出现的次数,当出现次数为1时可以利用已匹配的信息加大移动距离,同时利用文本串中不匹配字符后面的一个字符进行匹配,从而得到一个移动距离.将不同移动规则下获得的移动距离的最大值作为实际的移动距离,依次进行,直到匹配完成.实验结果表明,BMHF算法的CPU运算时间比典型的模式匹配算法可平均节省5.7%,平均匹配次数减少12.5%.更多还原

【Abstract】 A new fast pattern matching algorithm(called BMHF algorithm) is proposed to improve the detecting efficiency of network data based on attack signature and to decrease the packet loss rate in the intrusion detection system(IDS),by analyzing popular pattern matching algorithms such as BM algorithm,BMH algorithm and BMHS algorithm.A new function Q(X) is employed in BMHF to identify the number of a character X matching in the pattern string.When Q(X) equals one,the matched information is used to enlarge the shifting distance.A new shifting distance is also calculated according to the character next to non-matched characters in the pattern string.The maximum distance among these shifting distances is used in the BMHF algorithm.The process is repeated until the matching is completed.Experimental results show that the BMHF algorithm has better efficiency.The decrease in the operation time of CPU is 5.7 percent,and the decrease in the average number of matchings is 12.5 percent.更多还原