An improved Wu-Manber multiple patterns matching algorithm

NIDS is a powerful tool to defense the malicious attacks over the Internet. For the purpose of detecting the attack online, NIDS must inspect the payload of the packets very fast to expose the malicious code. String matching is a very important module in NIDS. To raise the performance of the string matching algorithm, we introduce an improved Wu-Manber algorithm QWM in this article. It combined the method of QS algorithm and used the mismatch information during the patterns matching, reached the top shift distance, improved the performance. We compared QWM with Aho-Corasick, Commentz-Walter and Wu-Manber algorithms. The experiment results shows on large alphabet such as English text and Chinese text, QWM algorithm has better performance, is faster than the other three algorithms. It can be used in various fields, such as network content analysis, intrusion detection, and text retrieval.