標題: 字串比對在入侵偵測/防護系統上針對Aho-Corasick演算法的強化與實現
Enhancing the Aho-Corasick Algorithm for Signature Based Anti-Virus/Worm Implementations
作者: 李韋儒
Lee, Wei-Zoo
李程輝
Lee, Tsern-Huei
電信工程研究所
關鍵字: 網路安全;字串比對;正規表示式;network security;string matching;regular expression
公開日期: 2010
摘要: 因為現在網路的迅速成長,字串比對已經在防毒/防蟲當中被視為一種很重要的技術。目前相當有名的字串比對演算法:Aho-Corasick (AC)演算法,是一個能夠同時比對多重字串,並且在各種環境之下都能夠保證穩定的輸出表現的演算法。AC演算法的發展是依照字串比對的方式,然而病毒/蠕蟲本身是可以利用正規表示式來表示。這篇論文裡,我們會將AC演算法作強化,用一種系統化的方式來實現這套延伸強化應用的AC演算法,以達到可以針對一般字串以及正規表示式作為表示的字串比對,並且能準確指出字串的來源以及在文件中出現之後到結束的位置。
Because of its accuracy, pattern matching is considered an important technique in anti-virus/worm applications. Among some famous pattern matching algorithms, the Aho-Corasick (AC) can match multiple patterns simultaneously and guarantee deterministic performance under all circumstances. However, the AC algorithm was developed for strings while virus/worm signatures could be specified by simple regular expressions. In this paper, we enhance the AC algorithm to systematically construct a signature matching system which can indicate the ending position in a finite input string for the occurrence of virus/worm signatures that are specified by strings or simple regular expressions. The regular expressions studied are those adopted in ClamAV for signature specification.
URI: http://140.113.39.130/cdrfb3/record/nctu/#GT079713556
http://hdl.handle.net/11536/44574
顯示於類別:畢業論文


文件中的檔案:

  1. 355601.pdf