Study of a fast Snort intrusion detection system
Shiyi Wang · Dalian Ligong Daxue xuebao · 2005
The main problem which needs to be sloved in high speed network is how to improve the detecting speed and efficiency.In this paper,the interrupt mitigation and zero copy method are adopted to improve the packet capturing performance of Snort system based on Linux,to achieve high speed rules matching,and an improved pattern matching algorithm based on BM is given.Experiment platform is set up to test the performance.Experiments show that the authors' proposal can obviously enhance the system's performance to Snort.