[Snort-devel] snort single pattern matching algorithm

Beliz Senyuz beliz.senyuz at ...2499...
Mon Apr 28 22:22:17 EDT 2008


Hi,

I am working on pattern matching algorithms. I want to find the occurrence
of a single pattern in a given text.

I found the Boyer-Moore Algorithm implementation in (src/mstring.c) Is this
code valid? Or even for single pattern search do I have to use Aho-Corasick?

Here is my question about Boyer-Moore implementation:
- search function mSearch which is in (src/mstring.c) is called from
(detection_plugins/sp_pattern_match.c)
- mSearch takes as parameter Boyer-Moore skip and shift tables
- skip and shift tables are computed by make_precomp function in
(detection_plugins/sp_pattern_match.c)
- make_precomp is called AFTER mSearch

How does it work? How the parameters can be computed after the function
call?

Thanks,

Beliz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20080428/caf87e2e/attachment.html>


More information about the Snort-devel mailing list