The Network Intrusion Detection System (NIDS) is an important part of any modern network. One of the important processes in NIDS is inspecting of individuals’ packets in network traffic, deciding if these packets are infected with any malicious activities. This process, which is called content matching, is done via string matching algorithms. The essences of each Network Intrusion Detection Systems are the underlying algorithms that perform the pattern matching process. These algorithms must have a low algorithmic complexity and must be able to match the input to multiple patterns simultaneously. In this paper, we present a variety of string matching algorithms that are used in contemporary Intrusion Detection Systems. We explain the fundamental differences in each approach and compare the algorithms based on criteria such as their application domain. In this paper, we present a survey of multiple keyword pattern matching algorithms for NIDS.

NIDS, pattern matching.