基于活跃规则集的Snort高效规则匹配方法  

Efficient rules matching method of Snort based on active rule sets

作　　者：张亚玲[1] 谢少春[1] 汤来锋[1] 

机构地区：[1]西安理工大学计算机科学与工程学院,西安710048

出　　处：《计算机工程与应用》2008年第24期124-127,共4页Computer Engineering and Applications

基　　金：陕西省自然科学基础研究计划项目 No.172006F37 ;陕西省教育厅专项科学研究计划资助项目No.2806JK231~~

摘　　要：对于基于特征的开源入侵检测系统Snort来说,如何提高速度以适应高速网络的发展是关键。在分析Snort新特性和现存多种规则匹配方法的基础上,考虑到大量Snort规则在一定时间内只有一小部分规则是活跃的,提出基于活跃规则集的Snort规则匹配方法,通过把每个端口下的规则分成活跃规则集与不活跃规则集,结合反馈规则匹配频度的思想,实时更新规则匹配顺序和控制活跃规则集大小,从而提高规则匹配速度。How to enhance the speed of Snort which is an open sources intrusion detection system to meet the development of the high speed network is important problem.After the analysis of new characteristics and several improvement methods of Snort rule matching,and by considering of only a small part of rules in massive Snort rules are active in certain time period,a new Snort rule matching method based on active rule sets is proposed in this paper.By dividing rule sets under the each port into the active rule sets and the inactive rule sets ,combining with feedback of the rule matching frequency,rule matching order is renewed and the sizes of active rule sets are limited in real time, so the rule matching speed can be improved.

关 键 词：基于网络的入侵检测系统(NIDS) 规则树 规则匹配 活跃规则集 匹配频度 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]