摘要： 为降低Snort2检测所耗费的CPU时间，针对端口分类所导致的规则重复构造问题，提出一种基于判定树的规则集有效划分方法，并对划分后的规则子集采用依据匹配项信息值的规则优化构造方式。实验通过高精度的时间测量结果证明该规则集优化构造方法使数据包检测所耗费的CPU时间比Snort2原方案平均降低45.9%。

关键词: Snort入侵检测, 判定树, 信息值, 规则匹配

Abstract: As to decrease the CPU time during detection in Snort2, this paper proposes a method based on decision tree to classify rule set aiming at avoiding needless rules construction resulted from port classification, and a better way to construct rule by information values of matching items is also adopted. Through precise timing, experimental result proves that the proposed way to construct rule set reduces detection time by 45.9% on average compared with Snort2.

Key words: Snort intrusion detection, decision tree, information value, rule matching

中图分类号: 

• TP393.08