Snort规则链表结构的分析与改进  

Analysis and improvement of structure of snort rule chain

作　　者：严书亭[1] 刘佳新[2] 王新生[1] 

机构地区：[1]燕山大学信息科学与工程学院,河北秦皇岛066004 [2]燕山大学现代教育技术中心,河北秦皇岛066004

出　　处：《燕山大学学报》2006年第3期272-275,共4页Journal of Yanshan University

摘　　要：Snort主要是根据规则树对数据进行递归匹配。因此规则树的结构是否合理,在很大程度上影响着Snort规则匹配的速度。本文对Snort规则链表结构进行了分析,并针对Snort规则树过于简单这一不足之处,对其进行改进,在保持原有规则匹配方法的基础上,增加宽度优先搜索算法,从而减少规则匹配所需时间。Snort analyses data according to regular tree mainly and adopts recursive method to match to it. So if the structure of the regular tree is rational, that influences the speed of snort rule matching. The structure of rule chain is analysed in this paper. Aimed at the deficiency of original rule tree, the improved rule tree is proposed. In order to reduce the time that rule matching needs, some work is done to add width-first searching algorithm based on original rule matching method.

关 键 词：基于网络的入侵检测系统 规则树 宽度优先 规则匹配 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]