入侵检测中的自适应模式匹配技术.pdfVIP

35 6 2009 3 Vol.35 No.6 Computer Engineering March 2009 ·· 2009 A TP309 ( 541004) (NIDS)NIDS NIDS AMPM AMPM NIDS 9.4%~29.1% Adaptive Pattern Matching Technology for Intrusion Detection GAO Chao-qin, CHEN Yuan-yan, LI Mei (College of Computer Science and Information Engineering, Guangxi Normal University, Guilin 541004) AbstractPattern matching computations dominate in the overall cost of running a Network Intrusion Detection System(NIDS). With network speed and the number of rules constantly increasing, pattern matching as a key component, is becoming the bottleneck in NIDS. Existing approaches to match pattern mostly apply statically-defined optimizations that do not take into account the characteristics of the network traffic and attack signatures. This paper proposes an adaptive multi-pattern matching algorithm specifically designed for network intrusion detection system, called AMPM. AMPM dynamically captures traffic and rules properties and intelligently selects the best suitable algorithm to detect packets. Experimental results show that the performance of existing NIDS applying AMPM improved by 9.4%~29.1% and AMPM is more appropriate for large rule set. Key wordsadaptive; pattern matching; intrusion detection; network security 1 [2] (Network Intrusion Detection System, Aho-Corasick (AC) NIDS)