Research and Improvement on Optimizing Snort Rule Sets
Gong Qing-ge · Computers & Security · 2009
The development of high speed network makes that how to improve the detection rate a key problem for the intrusion detection system. This paper proposed combining dividing active rule sets and dividing multi-subsets by analyzing and comparing several methods of optimizing the Snort rule sets, first choosing the rule sets for matching, and then parallel matching them to improve the matching rate effectively.