模式匹配技术在Snort中的应用和改进

目前有常用的几种模式匹配技术。在 snort 模式匹配方法中还有一定的局限性,协议匹配、字符串匹配也存在一些弊端。为了有效的提高入侵检测系统的可靠性,可以综合利用各种匹配技术并对匹配算法加以改进。采用协议分析大大减少模式匹配的计算量,提高匹配的精确度,减少误报率;对 BMH 算法的改进可以更进一步的提高匹配效率。从而开发出更高效的基于 Snort 的入侵检测系统。

Application and improvement of pattern matching technology in snort

There are several pattern matching technologies in common use currently.There is much limitation in snort's pattern matching methods.Protocol matching and character matching have their weakness too.We can synthetically make use of many matching technologies and improve upon them in order to availably improve Intrusion Detection System(IDS)'s dependability.Employing protocol analysis can greatly cut down the amount of calculation and improve accuracy and reduce the rate of positive error;improvement about BMH can further raise the rate of matching.Sequentially we can develop an efficient IDS based on Snort.