Optimization research on rule list in network intrusion detection system
Xu Zhao · Computer Engineering and Applications Journal · 2015
In order to improve the detecting efficiency and reduce the rate of dropping packets of Network Intrusion Detection System(NIDS), aiming at the existing problems of oversize RTN rule list and overlength average match length in the traditional rule list, by means of adding media type nodes, direction nodes and common OTN nodes to rule list, a thrice-decomposition method is proposed. This improvement can dramatically shorten the average match length of OTN nodes in NIDS. Various experimental results show that the improvement above can not only improve the detecting efficiency of NIDS, but also reduce the rate of dropping packets. More importantly, completeness of NIDS can be greatly promoted.