Analysis and Improvement of AC-BM Algorithm in Intrusion Detection System

Abstract

The advantage of the AC-BM algorithm is that it can conduct the matching search of multiple pattern strings simultaneously and the shift of the text string is optimized. However, it can only conduct the search in one text string at a time. In order to realize the search in multiple text strings simultaneously at a time, the multi-objective AC-BM algorithm is designed in the paper. With the automaton union operation technology, the multi-objective multi-pattern tree automaton is constructed; and with the bad character shift technology of the BM algorithm, the shift of text string set is calculated. In the Snort system, the 2-objective AC-BM algorithm and the 3-objective AC-BM algorithm is realized respectively. Experiment results show that the improved algorithms are obviously superior to the AC-BM algorithm regarding time property on the condition that if a pattern string is found in multiple text strings, the algorithm will stop (indicating that an attack is detected) .