Snort规则的分析与改进  

Analysis and improvement of rule of snort

作　　者：陈秀芳[1] 

机构地区：[1]无锡机电高等职业技术学校,江苏无锡214028

出　　处：《宁波职业技术学院学报》2010年第5期73-75,88,共4页Journal of Ningbo Polytechnic

摘　　要：Snort主要是根据规则树对数据进行递归匹配。因此,规则树的结构是否合理,在很大程度上影响着Snort规则匹配的速度。对Snort规则链表结构进行了分析,并针对Snort规则树进行改进,在保持原有规则匹配方法的基础上,使用New BM算法进行匹配,从而减少规则匹配所需时间。Snort mainly is carries on the recursion match according to the regular tree.Therefore regular tree＇s structure is whether or not reasonable will affect the Snort rule match speed in great degree.This article has carried on the analysis to the Snort regular chain table structure,and aims at the Snort regular tree to make the improvement,in the maintenance original rule match method foundation,uses New the BM algorithm to carry on the match,thus reduced the time which rule match needs.

关 键 词：入侵检测系统 规则树 算法 规则匹配 

分 类 号：TP39[自动化与计算机技术—计算机应用技术]