Research on Network Intrusion Detection Method based on Regular Expression Matching

Along with the rapid development of network technology and the rich variety of network applications, all kinds of network attacks and abnormal behavior is more and more rampant, which seriously interferes with the normal operation of the Internet. Based on regular expression, this paper studies the method of network intrusion detection, and proposes an improved grouping algorithm (IGA) to improve Yu algorithm based on the concept of expansion coefficient (EC). And we use the modified regular expression grouping algorithm to effectively group the regular expression set. Based on the open source software, we implement the improved regular expression matching engine, and carry out the grouping algorithm experiments and performance testing experiment. The experimental results we obtained is that the overall state number of IGA algorithm number is reduced by an average 27% compared with the overall state number of Yu algorithm under the condition of the same number of clusters, and the compilation time of MRegex 1.5 increases with the increase of the number of rules compared with PCRE. We can draw the following conclusions: (1) the total number of DFA state of the IGA algorithm is reduced in the same number of cases, and it also can reduce the memory space of the memory DFA, and the space complexity of the matching algorithm. 2) It can improve the efficiency of intrusion detection system. 3) Compared with PCRE (Perl Compatible Regular Expressions), the compilation time of MRegex 1.5 increases with the increase of the number of rules, and its matching speed can meet the requirements of the detection of gigabit network traffic.