The analysis and improvement of BM algorithm in Snort intrusion detection system

摘要

BM pattern matching algorithm is one of the most common matching algorithms in the intrusion detection system. Meanwhile, it is an important constituent part of the intrusion detection system. Its matching speed will influence the operating efficiency of the whole system directly. The enhanced BM algorithm is studied and realized the increase of the offset when characters match and improved the pattern matching speed. By analyzing the matching situation of the characters after the partial matching characters, the character offset is adjusted again, while is increasing the moving distance of the pattern string and reducing the comparison times of the matching operation, so the matching efficiency is improved. When put the algorithm into the detection engine of Snort intrusion detection system, the detection speed increased by 7%–9%.