针对模式匹配算法已经成为误用入侵检测系统性能瓶颈的现状,提出了一种新的基于后缀树的多模式匹配算法FSM(Fast String Matching Algorithm)。该算法构建了一个后缀自动机,匹配中应用了好后缀启发机制进行启发跳跃。将改算法在Snort2.4.3中实现,实验结果表明,在耗费一定空间的基础上,Snort的时间性能有了较大提高。
The performance of pattern matching algorithm has been the bottleneck of misuse-based intrusion detection system. A suffix tree- based multi-pattern matching algorithm FSM is presented A suffix automaton is constructed, and the good suffix heuristic mechanism is used in pattern matching. The algorithm is implemented in Snort 2.4.3. The experiment shows that the detection speed of Snort is highly improved, meanwhile more memory is consumed.