Conflict detection based on snort rules
Yongji Wang · Jisuanji gongcheng yu sheji · 2008
To resolve the rule conflict problem which may cause ambiguity in alarm and moreover lead to false positive and false negative in Snort intrusion detection system,a conflict detection method is proposed.First this method define the relation between rules,express rule and expose rule relation by tree structure with one root node,and then define conflict type in terms of rule relation and relative position and use conflict state transition graph to reflect the process of conflict detection.Based on these,the algorithm for conflict detection is proposed.By checking part of rules of Snort,the result shows that this method can detect conflict between rules effectively.