Snort的高效规则匹配算法  

Efficient Rule-matching Algorithms on Snort

作　　者：谷晓钢[1] 江荣安[1] 赵铭伟[1] 

机构地区：[1]大连理工大学电信学院计算机系,大连116023

出　　处：《计算机工程》2006年第18期155-156,213,共3页Computer Engineering

摘　　要：对入侵检测系统Snort的规则匹配算法进行了系统的分析,为了进一步提高Snort的规则匹配效率,提出了在匹配过程中,对于条件匹配处理函数应用参数链表驱动的方法。从而避免重复调用处理函数,充分利用参数之间的关系,并能动态地减少无效规则的匹配。通过两个实验来评估此方法的效率,结果表明改进方案较明显地提高了Snort的检测性能。This paper systematically analyzes the rule matching algorithm of Snort, an open source-code NIDS. In order to increase effectively the rule matching speed, an approach of parameter-list-driven is proposed for the conditional checking subroutine during rule matching. The means can avoid repeatedly invoking the checking subroutines, can utilize relationship between parameters, and can significantly reduce invalid rules in the running time. Finally, two experiments are done for evaluating the efficiency of it. The result shows the approach can greatly improve the detecting performance of Snort.

关 键 词：基于网络的入侵检测系统 规则匹配 参数驱动 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]