Comparison of pattern matching algorithm for enhancing snort performance

Abstract

Nowadays, intrusion detection system has become widely used as a network perimeter security. The used of IDS to deter the massively sophisticated attacks in most of our industries, governmental organization and educational institutions .However ,Intrusion detection system can be either host-based or network based intrusion detection system, in a host-base intrusion it monitors the host where its configured while the network-based IDS it monitors both inbound and outbound traffic network. In addition, signature based or anomaly based detection techniques are used to detect anomalous packets or attack in both network and host-based intrusion detection systems. Therefore, the challenges faced by most of the signature based detection systems e.g. snort tool is inability to detect malicious traffic at higher traffic network, which resulted in a packet drooping and subjected the network where this signature based system is configured as a network perimeter security. The challenges resulted as a result of inefficiency of the pattern matching algorithms to efficiently perform pattern matching. In addition, this research work aim to compare the current modified Boyer Moore pattern matching algorithm used by the snort IDS with the Native pattern matching algorithm in order to evaluate their performance and recommend for the implementation of the new pattern matching algorithm that will enhance snort detection performance.