关键词: 多模式串匹配, 有限自动机, 关键字检测过滤, 入侵检测

Abstract:

For the weakness of low string matching speed in intrusion detection field, a fast improved algorithm to perform multiple pattern matching in a string was presented. In general, the algorithm described does not need to test each character in the string. By making full use of the results of matching successes and failures, the algorithm can often bypass inspection of as many characters as possible and get all matching locations after one quick search.Secondly,the new algorithm can match Chinese string due to using a combinatorial state automaton. Experimental results demonstrate that the proposed algorithm achieves excellent performance of detection and is helpful to reduce systematical missing package rate.

Key words: multiple pattern match, finite state automaton, keywords detection and filtering, intrusion detection