一种字符串压缩全模式匹配的主机入侵防御算法

摘要

In view of hidden safety problem of existing list matching algorithm caused by the file path of the list using plaintext mode,we pro-pose a string compression-based list matching algorithm used for full pattern matching.First,the MD5 operation is executed on the strings with filesfull path preserved,then the MD5 value and the binary path data compressed and processed into 16 bytes are merged to carry out modulo operation,and finally the elements in the list are converted into a 32-byte structure.Comparison is made through simulation experiments on three algorithms ofthe simple matching algorithm,BMand compression with regard to the memory usage,traversing time,search time and the number of repetitions.Experiments show that the performance and the security of the algorithm proposed in this paper outperform the others.%针对现有名单匹配算法由于对名单中文件路径使用明文保存方式存在安全隐患，提出一种基于字符串压缩的用于全模式匹配的名单匹配算法。首先对保存有文件全路径的字符串进行MD5运算，然后将MD5值与压缩处理成16个字节的二进制路径数据合并进行求模运算，最终将名单元素转化成一个32字节结构体。通过仿真实验对朴素匹配算法、BM、压缩三种算法在内存使用、遍历时间、查找时间以及重复数上进行比较，实验结果表明，所提出的算法在性能以及安全性上优于其他算法。