Abstract:

A method of establishing rule set of snort based on frequency is proposed to enhance the efficiency of rule matching of snort intrusion detection system. Snort system analyzes network packets using rule set to find intrusion behaviors. A method is proposed which creates rule trees by the principle of low frequency first matching after calculating the frequency of each packets option, to decrease matching times and raise efficiency. By analysis of experimentation, it is proved that method based on frequency combined with parameter set archives excellent effects and enhances matching efficiency compared with Snort2 method.

Key words: Snort system, intrusion detection, frequency, rule matching

摘要：

为提高Snort入侵检测系统的规则匹配效率，提出一种基于频率的Snort规则集构造方法。Snort系统使用规则集对网络数据包进行匹配分析，发现入侵行为。通过计算数据包样本中各选项的频率，在构造规则树时，采用频率小先匹配的原则，减少匹配次数，提高系统效率。实验结果表明，与Snort2方法相比，该方法配合参数集合匹配的匹配效率较高。

关键词: Snort系统, 入侵检测, 频率, 规则匹配

CLC Number: 

• TP309.2