An Improved Technology for Content Matching Intrusion Detection System

Abstract

Pattern matching is a comprehensive applicable key technology, which can be used in network security applications such as intrusion detection systems (IDS), firewall, virus detection, etc. Depending on the choice of algorithm, implementation, and the frequency to which it is applied, the pattern matching may become a performance bottleneck due to the increasing network speed and traffic. Therefore, it is very necessary to develop faster and more efficient pattern matching algorithms in order to overcome the troubles on performance. In this paper, we presented a new pattern matching algorithm based on Boyer-Moore algorithm. The improved algorithm and its working process are described in detail. Together with a new concept of reference point, a two-dimensional array NEXT redesigned based on novel generated rules in the pre-processing phase, endorse the algorithm a better performance and more efficient. The algorithm also passed tests and is validated. Our experimental results, two diverse sets of pattern strings tested on two example texts, indicate that this algorithm can enhance the average performance up to 25% ~ 44% compared to Boyer-Moore-Horspool algorithm