基于Snort的入侵检测引擎比较分析  

Intrusion detection engine comparison based on Snort

作　　者：唐谦[1] 张大方[1] 

机构地区：[1]湖南大学计算机与通信学院,湖南长沙410082

出　　处：《计算机工程与设计》2005年第11期2884-2886,共3页Computer Engineering and Design

基　　金：国家自然科学基金项目(60273070)

摘　　要：基于误用的入侵检测系统性能在很大程度上取决于其检测引擎的性能。为了满足网络流量和速度的增大,设计高性能的入侵检测引擎将成为一项紧迫的任务。首先介绍了Snort系统的工作原理和检测引擎的分类,然后对在Snort2.0和Snort-ng中实现的最新检测引擎进行了详细分析。实验结果表明,Snort2.0在速度和内存消耗上都优于Snort-ng,但Snort-ng的检测引擎为今后入侵检测引擎的设计开辟了一条新的思路,但将它作为发展下一代Snort技术中的检测引擎还需要不断完善。Misuse-based of intrusion detection system is decided by the performance of its detection engine to a large extent. For satisfying the increasing network traffic and speed, design the high performance intrusion detection engine will become an urgent mission. The principle of Snort and detection engine classification were introduced at first, and then two kinds of latest detection engines were analyzed that realized in Snort2.0 and Snort-ng. Experimental results show that the detection engine in Snort2.0 is better than Snort-ng in the aspect of speed and memory consumption, but the detection engine in the Snort-ng finds a new way to design the intrusion detection engine, using as intrusion detection engine in the next generation Snort, which needs continuously perfect.

关 键 词：入侵检测引擎 模式匹配 规则 SNORT 决策树 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]