A fast pattern matching algorithm with multi-byte search unit for high-speed network security

摘要: A signature-based intrusion detection system identifies intrusions by comparing the data traffic with known signature patterns. In this process, matching of packet strings against patterns is most time-consuming step and dominates overall performance. Many network systems (NIDS), e.g., Snort, employ one or multiple pattern algorithms to detect attack types. So far, many have been proposed. Most them use single-byte standard unit for search, while a few such as Modified Wu-Manber (MWM) algorithm typically two-byte unit, which guarantees better performance than others even number different signatures increases. Among those algorithms, MWM has fastest when in rule set rarely appear packets. However, time increases length shortest group decreases. paper, extending pattern, we minimize uses multi-byte unit. We propose new called L^+^1-MWM multi-pattern matching. The proposed minimizes degradation that originated from dependency on pattern. show improves much 20% average under various lengths normal conditions. Moreover, less 5, shows 38.87% enhancement average. also conduct experiments real campus 12.48% obtained addition, it shown provides 25% numbers conditions, 20.12% on-line traffic.