“软件人”入侵检测系统数据收集器的优化  

Optimization of "SoftMan" IDS Data Collector

作　　者：郑军[1] 马占飞[2] 卢荣[1] 

机构地区：[1]包头师范学院网络中心,内蒙古包头014030 [2]包头师范学院信息科学与技术学院,内蒙古包头014030

出　　处：《阴山学刊（自然科学版）》2013年第1期17-19,共3页Yinshan Academic Journal(Natural Science Edition)

基　　金：包头师范学院青年基金项目(BSYKJ2012-30);国家自然科学基金项目(61163025)

摘　　要：本文首先对基于"软件人"的入侵检测系统的总体架构进行了概要性的介绍。在入侵检测系统中,Snort担负着重要的入侵检测模式匹配的任务,是系统最为耗时的一个环节。接着,论文对Snort入侵检测流程进行了详细的分析,提出传统Snort在规则模式匹配中存在重复调用子函数、规则匹配次序不合理、规则项匹配次序不合理这三大缺陷。针对以上这三个问题,本研究重新设计了Snort的模式匹配算法,并且根据匹配算法的需要改进了传统规则语法树的数据结构。This paper is based on the ＂SoftMan＂ of the intrusion detection system framework is briefly intro- duced. In intrusion detection system, Snort plays an important intrusion detection pattern matching task, is one of the most time -consuming phase for the system. Then, the paper has carried on the detailed analysis to the Snort intrusion detection process, the traditional Snort in regular pattern matching in repeated calls to functions, rules matching order is not reasonable, rules matching order unreasonable to the three major defects. In view of the above three problems, this research redesigned the Snort pattern matching algorithm, and according to the need of matc-hing algorithm improves the data structure of the traditional rules of syntax tree.

关 键 词：软件人 SNORT 模式匹配 入侵检测 规则树 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]