基于Snort入侵检测系统的改进优化

在深入研究和分析Snort入侵检测系统的基础上，对原有系统提出了新的改进设计方案，解决了Snort系统不能及时检测未知入侵行为的问题．同时，根据Snort流出数据的特征，统计了其出现频率，将存在威胁的数据特征动态加入到Snort异常特征库中，实现了对未知入侵的拦截．改进后的系统可有效防止未知的入侵事件，降低了丢包率，提高了系统的全面检测能力．

An Improved Intrusion Detection System Based on Snort

Based on the analysis of the Snort intrusion detection system, a new improved scheme was put forward to solve the problem that Snort system can＇ t detect unknown intrusion events timely. According to the characteristics of data outflow from Snort, its frequency was counted, and the characteristics of threaten data were added into the Snort abnormal feature library, and the unknown intrusion interception were realized. The improved system prevents the unknown intrusion events effectively, reduces the loss rate of the data packets and improves the comprehensive detection ability of intrusion detection system.