{"title":"Research on Detection Speed Improvement of Snort","authors":"Qing-duan Meng, Xiaoling Zhang, Dongwei Lv","doi":"10.1109/ITAPP.2010.5566613","DOIUrl":null,"url":null,"abstract":"An improved AC_BMH (Aho-Corasick_Boyer-Moore-Horspool) algorithm was proposed in this paper, which combines advantages of both double-character skip and QS (Quick Search) algorithm, and increases the jumping distance of pattern string when pattern strings matching fails. Experiment results show that the matching speed of string is improved by 22.85%-42.79% by using the proposed algorithm. By modifying both preprocessing and pattern matching process components, the proposed algorithm was applied to Snort detection system, and experiment results show that the detecting speed of Snort is improved about 5.95%-25.54%, and the increased memory usage, not over 80MB, almost not affect the computer performance.","PeriodicalId":116013,"journal":{"name":"2010 International Conference on Internet Technology and Applications","volume":"49 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2010-09-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"1","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"2010 International Conference on Internet Technology and Applications","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/ITAPP.2010.5566613","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 1
Abstract
An improved AC_BMH (Aho-Corasick_Boyer-Moore-Horspool) algorithm was proposed in this paper, which combines advantages of both double-character skip and QS (Quick Search) algorithm, and increases the jumping distance of pattern string when pattern strings matching fails. Experiment results show that the matching speed of string is improved by 22.85%-42.79% by using the proposed algorithm. By modifying both preprocessing and pattern matching process components, the proposed algorithm was applied to Snort detection system, and experiment results show that the detecting speed of Snort is improved about 5.95%-25.54%, and the increased memory usage, not over 80MB, almost not affect the computer performance.
京公网安备 11010802042870号
京ICP备2023020795号-1
分享
求助内容：
应助结果提醒方式：
扫码关注我们
