计算机工程与应用 ›› 2017, Vol. 53 ›› Issue (4): 39-44.DOI: 10.3778/j.issn.1002-8331.1608-0004

• 热点与综述 • 上一篇    下一篇

支持模式串动态更新的多模式匹配Karp-Rabin算法

王  歧1,2,3,卢毓海1,3,刘  洋1,3,刘燕兵1,3,谭建龙1,3,孙  波4   

  1. 1.中国科学院 信息工程研究所,北京 100093
    2.中国科学院大学,北京 100049
    3.信息内容安全技术国家工程实验室,北京 100093
    4.国家计算机网络应急技术处理协调中心,北京 100029
  • 出版日期:2017-02-15 发布日期:2017-05-11

Dynamical adaptive Karp-Rabin multi-pattern matching algorithm

WANG Qi1,2,3, LU Yuhai1,3, LIU Yang1,3, LIU Yanbing1,3, TAN Jianlong1,3, SUN Bo4   

  1. 1.Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China
    2.University of Chinese Academy of Sciences, Beijing 100049, China
    3.National Engineering Laboratory for Information Security Technologies, Beijing 100093, China
    4.National Computer Network Emergency Response Technical Team Coordination Center of China, Beijing 100029, China
  • Online:2017-02-15 Published:2017-05-11

摘要: 多模式匹配算法是网络监测和内容过滤系统的核心算法,但是现有的多模式匹配算法无法实现高并发下动态更新模式串的功能。通过改进Karp-Rabin 算法,实现了多模式字符串匹配技术,实验表明多模式Karp-Rabin算法具有良好的性能。随后在多模式Karp-Rabin 算法的基础上进一步改进,使其在高并发情况下能够支持模式串动态增删功能。实验表明该算法在单个线程不断更新的条件下,随着扫描线程个数的增加,搜索速度能够保持线性增长。

关键词: 多模式匹配, Karp-Rabin算法, 动态更新, 入侵检测系统, 多线程

Abstract: Multi-pattern matching algorithm plays an important role in network monitoring and filtering system, but the existing multi-pattern matching algorithms can not achieve the function of updating patterns dynamically with high concurrencies. Firstly, the paper has realized multi-pattern matching technology by improving Karp-Rabin algorithm. Experiments show that the improved algorithm exhibits good performance. Then on the basis of the improvement, functionality of updating patterns dynamically is improved. Experiments show that if there is a single thread updating continuously, search speed keeps linear growth with the increase of scanning thread.

Key words: multi-pattern matching, Karp-Rabin, updating dynamically, intrusion detection system, multi-thread