SNORT规则匹配算法改进

检测引擎作为入侵检测系统(IDS)的核心模块,基本上采用基于模式匹配的检测方法,选择设计1个好的模式匹配算法对入侵检测系统的性能至关重要。对SNORT的原有规则匹配算法bm进行改进,在改进规则匹配算法中,将具有相同前缀的规则生成1棵规则树,在规则匹配的过程中将数据包内容和规则树进行匹配,在匹配时,可以和多个规则同时进行,大大减少了在规则匹配中花费的时间,从而提高了SNORT的性能。改进后的系统和原来系统进行了几种测试,通过测试改进后的系统比原来的系统速度明显提高。在流量大的情况,丢包情况也减少了。

Master and Application of Snort Tools for Intrusion Detection

As the core module of invasion detection system,detection engine generally uses the methods based on pattern matching.When improving the rule matching algorithm,a rule tree was built from the rules which have the same prefix.In matching these rules,the content of data package and rules tree can be matched with many other rules simultaneously so as to reduce the time and improve the function of SNORT.The comparison of the original system with the improved one showed that the speed of the latter is faster than the former,and when the current is large,the loss of package can be reduced obviously.