An Improved AC Algorithm for Intrusion Detection

On the basis of analyzing AC algorithm in IDS, this paper presents an improved AC algorithm named double compression AC algorithm(DCAC), describes it's new state automaton storage compression and corresponding matching process. DCAC has been tested in Snort. The results show that DCAC can averagely enhance the performance of Snort by 52.2% in terms of memory usage and by 73.5% in terms of processing time compared to the standard AC algorithm.