模式匹配技术在Snort中的应用和改进  

Application and improvement of pattern matching technology in snort

作　　者：王秀英[1] 徐国芹[2] 

机构地区：[1]辽宁工程技术大学 [2]职业技术学院,辽宁阜新123000

出　　处：《辽宁工程技术大学学报（自然科学版）》2004年第z1期116-118,共3页Journal of Liaoning Technical University (Natural Science)

摘　　要：目前有常用的几种模式匹配技术。在 snort 模式匹配方法中还有一定的局限性,协议匹配、字符串匹配也存在一些弊端。为了有效的提高入侵检测系统的可靠性,可以综合利用各种匹配技术并对匹配算法加以改进。采用协议分析大大减少模式匹配的计算量,提高匹配的精确度,减少误报率;对 BMH 算法的改进可以更进一步的提高匹配效率。从而开发出更高效的基于 Snort 的入侵检测系统。There are several pattern matching technologies in common use currently.There is much limitation in snort's pattern matching methods.Protocol matching and character matching have their weakness too.We can synthetically make use of many matching technologies and improve upon them in order to availably improve Intrusion Detection System(IDS)'s dependability.Employing protocol analysis can greatly cut down the amount of calculation and improve accuracy and reduce the rate of positive error;improvement about BMH can further raise the rate of matching.Sequentially we can develop an efficient IDS based on Snort.

关 键 词：SNORT 模式匹配 协议分析 匹配算法 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]