Performance, Computing, and Communications Conference, 2002. 21st IEEE International (2006)
Phoenix, AZ, USA
Apr. 10, 2006 to Apr. 12, 2006
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/.2006.1629469
null Yang Dong hong , Dept. of Comput. Sci.&Technol., Tsinghua Univ., Beijing, China
null Xu Ke , Dept. of Comput. Sci.&Technol., Tsinghua Univ., Beijing, China
null Cui Yong , Dept. of Comput. Sci.&Technol., Tsinghua Univ., Beijing, China
NIDS is a powerful tool to defense the malicious attacks over the Internet. For the purpose of detecting the attack online, NIDS must inspect the payload of the packets very fast to expose the malicious code. String matching is a very important module in NIDS. To raise the performance of the string matching algorithm, we introduce an improved Wu-Manber algorithm QWM in this article. It combined the method of QS algorithm and used the mismatch information during the patterns matching, reached the top shift distance, improved the performance. We compared QWM with Aho-Corasick, Commentz-Walter and Wu-Manber algorithms. The experiment results shows on large alphabet such as English text and Chinese text, QWM algorithm has better performance, is faster than the other three algorithms. It can be used in various fields, such as network content analysis, intrusion detection, and text retrieval.
QS algorithm, Wu-Manber multiple pattern matching, network intrusion detection system, NIDS, malicious attack, Internet, online attack detection, string matching, QWM algorithm
n. Yang Dong hong, n. Xu Ke and n. Cui Yong, "An improved Wu-Manber multiple patterns matching algorithm," Performance, Computing, and Communications Conference, 2002. 21st IEEE International(PCC), Phoenix, AZ, USA, 2006, pp. 91.