一种高效的Snort规则匹配模式

A highly efficient model of Snort Rule-matching

针对基于Snort的入侵检测系统在高网速下的高漏报率的情况,本文提出了利用关联规则和动态规则集的Snort规则匹配模式,该模式利用前后两次攻击之间存在的联系,通过基于关联规则的数据挖掘找出上次匹配成功规则的关联规则,把捕获的数据包和这些关联规则进行匹配,以此来缩小规则匹配的范围,提高匹配成功的概率,提高了Snort在高网速下的性能。

Aiming to the problem of high rate of false negatives of Snort,this paper proposes one model of Snort Rule-mathing,which is based on Association Rules and Dynamic Rules Set.This model maths the caught data-bag with Association Rules of former succeed mathing-rule that are mined by making use of Association of two intrusion,which can decrease the scope of Rule-mathing and increase success rate of Rule-mathing to complete improving performance of Snort in high network speed.