Improvement of Matching Mechanism in Snort
Dongyang Xu · Microcomputer Information · 2009
The pattern matching based on rule is the main mechanism in the detection engine of Snort. Based on the combination of protocol analysis and pattern matching, we improved the matching mechanism in snort. Firstly, we foreclose the data packet gains from the network, analyzing the data packet by using the technology of protocol analysis; based on the result, we match the other corresponding information of data packet by using a new algorithm of pattern matching; all of these can raise the efficiency of rule matching in Snort obviously. Finally a performance test is held, which shows that the improved snort has better performance.