基于判定树的Snort规则集优化构造方法  

Method for Snort Rule Set Optimal Construction Based on Decision Tree

作　　者：梁萍[1] 帅建梅[1] 谭小彬[1] 周宇[1] 

机构地区：[1]中国科学技术大学信息科学技术学院,合肥230027

出　　处：《计算机工程》2011年第2期117-119,共3页Computer Engineering

基　　金：国家"863"计划基金资助项目(2006AA01Z449)

摘　　要：为降低Snort2检测所耗费的CPU时间,针对端口分类所导致的规则重复构造问题,提出一种基于判定树的规则集有效划分方法,并对划分后的规则子集采用依据匹配项信息值的规则优化构造方式。实验通过高精度的时间测量结果证明该规则集优化构造方法使数据包检测所耗费的CPU时间比Snort2原方案平均降低45.9%。As to decrease the CPU time during detection in Snort2, this paper proposes a method based on decision tree to classify rule set aiming at avoiding needless rules construction resulted from port classification, and a better way to construct rule by information values of matching items is also adopted. Through precise timing, experimental result proves that the proposed way to construct rule set reduces detection time by 45.9% on average compared with Snort2.

关 键 词：SNORT入侵检测 判定树 信息值 规则匹配 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]