Improvement and Simulation of Snort Rule Chains Structure
Min Sun, Xiaoming Gu, Zhi-Li Zhang · Jisuanji gongcheng · 2009
For finding attacks,Snort matches the captured packets with rule chains,therefore the rationality of the rule chains influences the detection speed of Snort greatly.This paper factors out common options from the rule chains,for solving the problem of local accumulation.It sorts the rules according to information quantity of the options.Simulation results of the OPNET shows that the improved rule chains structure can reduce the time of rules matching.