Research of new method for increasing rule matching speed of Snort

doi:10.3778/j.issn.1002-8331.2009.28.032

Computer Engineering and Applications ›› 2009, Vol. 45 ›› Issue (28): 109-111.DOI: 10.3778/j.issn.1002-8331.2009.28.032

• 网络、通信、安全 • Previous Articles Next Articles

Research of new method for increasing rule matching speed of Snort

WANG Jie，WANG Tong-jun，SUN Ke-ke

College of Electrical Engineering，Zhengzhou University，Zhengzhou 450001，China

Received:2008-05-27 Revised:2008-09-04 Online:2009-10-01 Published:2009-10-01
Contact: WANG Jie

提高Snort规则匹配速度的新方法

王杰，王同军，孙珂珂

郑州大学电气工程学院，郑州 450001

通讯作者: 王杰

Abstract

Abstract: In order to accommodate to the development of high-speed network，this article analyzes the rule-matching algorithm of Snort，an open source-code NIDS，and puts forward a new improved algorithm on the basis of original rule matching algorithm of Snort.This new algorithm can increase the rule matching speed efficiently through reducing the times of moving pattern strings and increasing the times of the furthest moving distance m+1 appearing.Finally，experiments are carried out for evaluating the efficiency of this algorithm.The results show that the approach can greatly improve the rule matching speed of Snort.

Key words: intrusion detection system, Snort, rule matching

摘要： 对于基于特征的开源入侵检测系统Snort来说，如何提高规则匹配速度以适应高速网络的发展是关键。对Snort的规则匹配算法以及现有的两种著名的匹配算法BMH与BMHS算法进行比较分析，提出一种简单实用、易于理解的规则匹配改进算法。该算法通过减少模式串的移动次数以及增加最大移动距离m+1的出现次数来减少规则匹配所需要的时间，进而提高了Snort 规则匹配速度。实验测试结果表明该算法能够有效地提高Snort的规则匹配速度。

关键词: 入侵检测系统, Snort, 规则匹配

CLC Number:

TP393.08

WANG Jie，WANG Tong-jun，SUN Ke-ke. Research of new method for increasing rule matching speed of Snort[J]. Computer Engineering and Applications, 2009, 45(28): 109-111.

王杰，王同军，孙珂珂. 提高Snort规则匹配速度的新方法[J]. 计算机工程与应用, 2009, 45(28): 109-111.

[1]	YU Enze, Nurbol, YU Qing. Phishing Website Detection Method Based on Integrated Learning [J]. Computer Engineering and Applications, 2019, 55(18): 81-88.
[2]	LIU Haiyan, ZHANG Yu, BI Jianquan, XING Meng. Review of technology based on distributed and collaborative network intrusion detection [J]. Computer Engineering and Applications, 2018, 54(8): 1-6.
[3]	WANG Qi1，2，3, LU Yuhai1，3, LIU Yang1，3, LIU Yanbing1，3, TAN Jianlong1，3, SUN Bo4. Dynamical adaptive Karp-Rabin multi-pattern matching algorithm [J]. Computer Engineering and Applications, 2017, 53(4): 39-44.
[4]	SI Jian, CHEN Peng, GU Ningping, SUN Lingfeng, WANG Weimin. Network attack graph backward depth-first building algorithm [J]. Computer Engineering and Applications, 2017, 53(3): 131-137.
[5]	LV Xuefeng1，2, JIANG Liehui1，2, MENG Huan2. Cyber threats and intrusion detection for MODBUS-based SCADA system [J]. Computer Engineering and Applications, 2017, 53(24): 122-128.
[6]	DING Yan, Nurbol. Phishing detection method based on URL obfuscation technology recognition [J]. Computer Engineering and Applications, 2017, 53(20): 75-82.
[7]	SUN Jian, LIU Yuan, ZHAO Xinjie. Detection of application layer DDoS attacks based on clustering [J]. Computer Engineering and Applications, 2016, 52(21): 116-120.
[8]	ZHAO Xu, WANG Wei. Multithreading model for multimedia packets in NIDS based on genetic algorithm [J]. Computer Engineering and Applications, 2016, 52(14): 115-118.
[9]	CHEN Ming1, WEN Ying1, TAN Tao2. Intrusion detection system based on MDP and game theory in WSN [J]. Computer Engineering and Applications, 2015, 51(9): 117-121.
[10]	ZHAO Xu, WANG Wei. Optimization research of DSAMDP method with dynamic programming theory [J]. Computer Engineering and Applications, 2014, 50(22): 83-87.
[11]	ZENG Chuanhuang, HUANG Kan. Research and implementation of new method on increasing speed of rule-matching in Snort [J]. Computer Engineering and Applications, 2014, 50(22): 102-105.
[12]	ZHANG Wei1, DONG Qunfeng2. Design and implementation of cloud security comprehensive analysis system [J]. Computer Engineering and Applications, 2014, 50(19): 89-94.
[13]	WENG Guang’an. Simulation dataset based study on byte frequency intrusion detection [J]. Computer Engineering and Applications, 2014, 50(12): 96-99.
[14]	LEI Xiangyu, ZHOU Ping. Research of support vector machine classifiers for intrusion detection [J]. Computer Engineering and Applications, 2013, 49(11): 88-91.
[15]	YAN Hongwen. Research on improved BMH single-pattern matching algorithm based on Snort [J]. Computer Engineering and Applications, 2012, 48(31): 78-81.

Research of new method for increasing rule matching speed of Snort

提高Snort规则匹配速度的新方法

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics