摘要： 传统的Snort系统引入单模式匹配速度较快的BM算法进行特定的模式匹配。文献[1]在Snort系统中引入了基于KMP的多模式匹配算法,能有效地提高系统的性能。但是该匹配算法本身存在着局限性,以致于无法完成含有多Content属性选项规则的匹配工作。该文从 多content属性选项的规则匹配问题着手,提出了解决方案,从而进一步推进了多模式匹配算法在IDS中的引入。

关键词: 入侵检测, 多模式匹配, 状态树

Abstract: Traditional Snort system introduces high speed single-pattern matching BM algorithm for specific pattern matching, while document [1] introduces a multi-pattern matching algorithm based on KMP, by which the systematic performance of Snort can be effectively improved. However the algorithm has its limitations too. It is unable to implement the matching work while a rule contains multiple properties. This article aims at the very point mentioned above and gives an effective solution, which largely accelerates the introduction of multi-pattern matching technology in IDS.

中图分类号: 

• TP393.08