Abstract:

For the weakness of low string matching speed in intrusion detection field, a fast improved algorithm to perform multiple pattern matching in a string was presented. In general, the algorithm described does not need to test each character in the string. By making full use of the results of matching successes and failures, the algorithm can often bypass inspection of as many characters as possible and get all matching locations after one quick search.Secondly,the new algorithm can match Chinese string due to using a combinatorial state automaton. Experimental results demonstrate that the proposed algorithm achieves excellent performance of detection and is helpful to reduce systematical missing package rate.

Key words: multiple pattern match, finite state automaton, keywords detection and filtering, intrusion detection