用于网络入侵检测的模式匹配新方法

针对新一代网络入侵检测系统(NIDS)的创建需要先进的模式匹配引擎,提出一种模式匹配的新方案，利用基于硬件的可编程状态机技术(B-FSM)来实现确定性处理过程。该技术可以在一个输入流中同时获取大量模式，并高效地映射成转换规则。通过对网络入侵检测系统中普遍采用的规则集(Snort)进行实验，实验结果表明该方法具有存储高效、执行速度快、动态可更新等特点,可以满足NIDS的需要。

New method of pattern-matching for network intrusion detection

New generations of Network Intrusion Detection Systems (NIDS) create the need for advanced pattern-matching engines. This paper presented a new scheme for pattern-matching, which adopted a hardware-based programmable state machine technology to achieve deterministic processing rates. A lot of patterns can be obtained in one input stream by Balanced Routing Table-based FSM (B-FSM), and transition rules can be mapped effectively. Experiments had been done with Snort used widely in network intrusion detection systems. The experimental results show that the method is effective in storage, fast in operation, and renewable dynamically. The method proposed in this paper can satisfy the requirement of NIDS.