一种高效的Snort规则匹配模式  

A highly efficient model of Snort Rule-matching

作　　者：张治国[1] 管群[1] 秦国亮[1] 

机构地区：[1]四川大学计算机学院,成都610065

出　　处：《微计算机信息》2009年第36期62-63,共2页Control & Automation

摘　　要：针对基于Snort的入侵检测系统在高网速下的高漏报率的情况,本文提出了利用关联规则和动态规则集的Snort规则匹配模式,该模式利用前后两次攻击之间存在的联系,通过基于关联规则的数据挖掘找出上次匹配成功规则的关联规则,把捕获的数据包和这些关联规则进行匹配,以此来缩小规则匹配的范围,提高匹配成功的概率,提高了Snort在高网速下的性能。Aiming to the problem of high rate of false negatives of Snort,this paper proposes one model of Snort Rule-mathing,which is based on Association Rules and Dynamic Rules Set.This model maths the caught data-bag with Association Rules of former succeed mathing-rule that are mined by making use of Association of two intrusion,which can decrease the scope of Rule-mathing and increase success rate of Rule-mathing to complete improving performance of Snort in high network speed.

关 键 词：关联规则 动态规则集 规则匹配 数据挖掘 

分 类 号：TP286[自动化与计算机技术—检测技术与自动化装置]