作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2010, Vol. 36 ›› Issue (22): 160-162. doi: 10.3969/j.issn.1000-3428.2010.22.057

• 安全技术 • 上一篇    下一篇

入侵检测系统中改进的AC_BMH算法

孟庆端,吕东伟,梁祖华   

  1. (河南科技大学电子信息工程学院,河南 洛阳 471003)
  • 出版日期:2010-11-20 发布日期:2010-11-18
  • 作者简介:孟庆端(1978-),男,副教授、博士,主研方向:信息安全,高温超导微波器件;吕东伟,硕士;梁祖华,高级工程师
  • 基金资助:

    国家青年基金资助项目(60904023)

Improved AC_BMH Algorithm in Intrusion Detection System

MENG Qing-duan, LV Dong-wei, LIANG Zu-hua   

  1. (School of Electronic and Informational Engineering, Henan University of Science and Technology, Luoyang 471003, China)
  • Online:2010-11-20 Published:2010-11-18

摘要:

提出一种改进的AC_BMH算法。该算法利用双字符进行跳跃,可以在增大模式串失配概率的同时跳过更大的距离,通过结合QS算法进一步增加模式串匹配失败时的跳跃距离,并借助压缩存储机制降低内存的使用量。实验结果表明,相比原AC_BMH算法,改进算法的字符串匹配速度提高了29%~52%,在模式串较多时,内存使用量可减少90%。

关键词: 模式匹配, 模式串, 入侵检测, AC_BMH算法

Abstract:

This paper proposes an improved Aho-Corasick_Boyer-Moore-Horspool(AC_BMH) algorithm, which utilizes double-character skip for both larger pattern strings mismatching possibility and further jumping distance, and combines Quick Search(QS) algorithm for even longer jumping distance when pattern strings matching fails. Compact storage mechanism is employed to decrease the amount of memory usage. Experimental results show that the matching speed of string is improved about 29%~52% with the improved algorithm, and the amount of memory used reduces about 90% when many pattern strings exist.

Key words: pattern matching, pattern string, intrusion detection, Aho-Corasick_Boyer-Moore-Horspool(AC_BMH) algorithm

中图分类号: