Research on Detection Speed Improvement of Snort

2010 International Conference on Internet Technology and Applications Pub Date : 2010-09-09 DOI:10.1109/ITAPP.2010.5566613

Qing-duan Meng, Xiaoling Zhang, Dongwei Lv

引用次数: 1

Abstract

An improved AC_BMH (Aho-Corasick_Boyer-Moore-Horspool) algorithm was proposed in this paper, which combines advantages of both double-character skip and QS (Quick Search) algorithm, and increases the jumping distance of pattern string when pattern strings matching fails. Experiment results show that the matching speed of string is improved by 22.85%-42.79% by using the proposed algorithm. By modifying both preprocessing and pattern matching process components, the proposed algorithm was applied to Snort detection system, and experiment results show that the detecting speed of Snort is improved about 5.95%-25.54%, and the increased memory usage, not over 80MB, almost not affect the computer performance.

查看原文本刊更多论文

提高Snort检测速度的研究

本文提出了一种改进的AC_BMH (Aho-Corasick_Boyer-Moore-Horspool)算法，该算法结合了双字符跳跃和QS (Quick Search)算法的优点，在模式字符串匹配失败时增加了模式字符串的跳跃距离。实验结果表明，该算法可将字符串匹配速度提高22.85% ~ 42.79%。通过修改预处理和模式匹配过程组件，将该算法应用于Snort检测系统，实验结果表明，Snort检测速度提高了5.95% ~ 25.54%，增加的内存占用不超过80MB，几乎不影响计算机性能。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

2010 International Conference on Internet Technology and Applications

自引率

0.00%

发文量