Research and improvement of MWM multi-mode matching algorithm

Multi-mode matching algorithm is the key to the intrusion detection´s performance. The paper analyzes WM algorithm, and shows the main disadvantages of MWM algorithm. Against these defects, we come up with an improved algorithm-IMWM algorithm, which uses repeated hash to solve string prefix conflict and reduce the number of match. Considering matching windows´ subsequent characters moving distance when the match failed, IMWM algorithm expands matching windows´ moving distance. With the same text string and pattern string, IMWM algorithm has promising improvements in matching performance comparing with MWM algorithm, which has been proved by experiments.