基于频率的Snort规则集构造方法  

Snort Rule Set Structure Method Based on Frequency

作　　者：周宇[1] 谭小彬[1] 何鲜宗[1] 奚宏生[1] 

机构地区：[1]中国科学技术大学信息科学技术学院,合肥230027

出　　处：《计算机工程》2010年第12期156-158,161,共4页Computer Engineering

基　　金：国家"863"计划基金资助项目(2006AA01Z449)

摘　　要：为提高Snort入侵检测系统的规则匹配效率,提出一种基于频率的Snort规则集构造方法。Snort系统使用规则集对网络数据包进行匹配分析,发现入侵行为。通过计算数据包样本中各选项的频率,在构造规则树时,采用频率小先匹配的原则,减少匹配次数,提高系统效率。实验结果表明,与Snort2方法相比,该方法配合参数集合匹配的匹配效率较高。A method of establishing rule set of snort based on frequency is proposed to enhance the efficiency of rule matching of snort intrusion detection system. Snort system analyzes network packets using rule set to find intrusion behaviors. A method is proposed which creates rule trees by the principle of low frequency first matching after calculating the frequency of each packets option, to decrease matching times and raise efficiency. By analysis of experimentation, it is proved that method based on frequency combined with parameter set archives excellent effects and enhances matching efficiency compared with Snort2 method.

关 键 词：SNORT系统 入侵检测 频率 规则匹配 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]