Snort Rule Set Structure Method Based on Frequency
Hongsheng Xi · Jisuanji gongcheng · 2010
A method of establishing rule set of snort based on frequency is proposed to enhance the efficiency of rule matching of snort intrusion detection system.Snort system analyzes network packets using rule set to find intrusion behaviors.A method is proposed which creates rule trees by the principle of low frequency first matching after calculating the frequency of each packets option,to decrease matching times and raise efficiency.By analysis of experimentation,it is proved that method based on frequency combined with parameter set archives excellent effects and enhances matching efficiency compared with Snort2 method.