Research and Improvement of a WM Multimode Pattern Matching Algorithm

The performance improvement of multi-pattern matching algorithm has an important impact on intrusion detection. For the two main disadvantages of the WM algorithm, one is to perform a pattern string filter only through the suffix table, and the other is that the average moving distance of the matching window on the text string is too small. Based on above theory, this paper proposes an improved WM algorithm I_WM. Firstly, the I_WM algorithm sorts all pattern strings according to the suffix characters of the pattern string matching window; then it calculates the hash value of the suffix character block in the text string matching window, searches the suffix table according to the hash value, determines the address range of the participating pattern strings, and filters the pattern strings that need to be matched for the first time; then it calculates the hash value of the prefix character block in the text string matching window, searches for the corresponding pattern strings in the prefix table according to the hash value and then traverses them, only the pattern strings within the address range specified by the suffix table need to be matched, which is the second filtration of pattern strings. By filtering twice, the number of pattern strings to be matched each time is greatly reduced. In addition, the text string matching window moves backward for the larger character block jump distances calculated by the BM and BMHS2 algorithms. The experimental test results show that under the same test environment, the I_WM algorithm has a certain degree of improvement over the WM algorithm in matching performance.