Research on Detection Speed Improvement of Snort

An improved AC_BMH (Aho-Corasick_Boyer-Moore-Horspool) algorithm was proposed in this paper, which combines advantages of both double-character skip and QS (Quick Search) algorithm, and increases the jumping distance of pattern string when pattern strings matching fails. Experiment results show that the matching speed of string is improved by 22.85%-42.79% by using the proposed algorithm. By modifying both preprocessing and pattern matching process components, the proposed algorithm was applied to Snort detection system, and experiment results show that the detecting speed of Snort is improved about 5.95%-25.54%, and the increased memory usage, not over 80MB, almost not affect the computer performance.