基于邮政综合网的Snort规则库的优化设计  

Optimal Design on Rule Base of Snort Based on Postal Comprehensive Network

作　　者：张宏宇[1] 蒋文保[2] 刘宝旭 

机构地区：[1]中国科学院研究生院,北京100049 [2]北京信息科技大学,北京100101 [3]中科院高能所计算中心,北京100049

出　　处：《信息安全与通信保密》2009年第3期93-95,共3页Information Security and Communications Privacy

基　　金：北京市自然科学基金项目(No.4072010);海南省自然科学基金项目(No.80639)

摘　　要：为了保护邮政综合网的网络安全,在该环境下部署Snort入侵检测系统,该技术可以保护邮政业务应用系统、邮政生产的正常运行。论文在此基础上,研究了如何对入侵检测系统的性能进行优化,文中从系统的核心部件规则库入手,依据细化的原则,应用协议分析技术,提出规则库的优化方案,并通过实验证明该优化方案可显著提高Snort入侵检测系统的性能。In order to protect the network security of Postal Comprehensive Computer Network, snort intrusion detection system is deployed in this network. This system can protect post business application system in normal operation of the postal production. On this basis, this paper studies how to optimize the performance of IDS. Beginning with the rule base of the core parts of system and based on the fining principle the optimization scheme of rule base is designed by protocol analysis technology. The experiment results show that this method is useful and available, could improve the whole performance of IDS.

关 键 词：邮政综合网 规则库 协议分析 

分 类 号：TN919.2[电子电信—通信与信息系统]