Research of a Pattern Matching Algorithm Based on Threshold and Word Frequency

The pattern matching algorithm performance's improvement has important influence on the efficiency of intrusion detection engine. This paper firstly analyzes BMHS2 algorithm, word frequency statistics and pattern threshold matching algorithm, and puts forward the improved threshold pattern matching algorithm. If there is a mismatch in matching process of BMHS2 algorithm, pattern string has larger average distance to the right and word frequency statistics matching can quickly find mismatched characters, which can reduce the invalid number of characters. The pattern string threshold matching can speed up the pattern string to the right. The modified pattern matching algorithm proposed in this paper firstly adopts the word frequency matching, and the characters with the lowest frequency in the pattern string are matched with the corresponding characters of the text string matching window. If they are the same, execute the pattern substring threshold matching. If the text string matching characters are not within the pattern substring threshold, the matching window moves to the right for the distance of the bigger value between the length of matched pattern substring and the length calculated from the BMHS2 algorithm. If the above two matching processes are all mismatched, the matching window uses the distance computed by BMSH2 algorithm moving to the right. The experimental results show that under the same test condition, the improved algorithm has better time performance than that of BMHS2.