关键词: 网络入侵检测系统, 可编程状态机, 模式匹配, 转换规则

Abstract: New generations of Network Intrusion Detection Systems (NIDS) create the need for advanced pattern-matching engines. This paper presented a new scheme for pattern-matching, which adopted a hardware-based programmable state machine technology to achieve deterministic processing rates. A lot of patterns can be obtained in one input stream by Balanced Routing Table-based FSM (B-FSM), and transition rules can be mapped effectively. Experiments had been done with Snort used widely in network intrusion detection systems. The experimental results show that the method is effective in storage, fast in operation, and renewable dynamically. The method proposed in this paper can satisfy the requirement of NIDS.

Key words: Network Intrusion Detection System (NIDS), Balanced Routing Table-based FSM (B-FSM), pattern-matching, transition rule