Snort软件代码分析、改进及再开发

出于研发网络入侵检测系统的需要,首先详细分析了入侵检测系统的规则链表结构;其次,针对snort规则链表的冗余提出一种改进方法,并证明了该方法的正确性和有效性;最后,以改进后的snort为内核,开发了网络入侵检测系统。并相继完成了包括Snort内核模块、用户认证模块、网络流量监视模块等的开发工作,完成了网络入侵检测系统的架构。经过验证,系统稳定、出色的性能再次证明了改进方法是有效的。

Analysis, Improvement and Redevelopment of the snort

Snort,one of the best Open Source Network Intrusion Detection Systems,is analysed in detail,in this paper,for the sake of searching network intrusion detection system.Then a solution is proposed to eliminate the redundancy of snort's rule chain.Experiments are done,which show that the solution proposed is correct and effective.Finally,on the basis of ARP technology approach,NIDS is developed with the improved snort as kernel module.Its excellent performance proves the solution to be valid once again.