基于活跃规则集的Snort高效规则匹配方法

对于基于特征的开源入侵检测系统Snort来说，如何提高速度以适应高速网络的发展是关键。在分析Snort新特性和现存多种规则匹配方法的基础上，考虑到大量Snort规则在一定时间内只有一小部分规则是活跃的，提出基于活跃规则集的Snort规则匹配方法，通过把每个端口下的规则分成活跃规则集与不活跃规则集，结合反馈规则匹配频度的思想，实时更新规则匹配顺序和控制活跃规则集大小，从而提高规则匹配速度。

Efficient rules matching method of Snort based on active rule sets

How to enhance the speed of Snort which is an open sources intrusion detection system to meet the development of the high speed network is important problem.After the analysis of new characteristics and several improvement methods of Snort rule matching,and by considering of only a small part of rules in massive Snort rules are active in certain time period,a new Snort rule matching method based on active rule sets is proposed in this paper.By dividing rule sets under the each port into the active rule sets and the inactive rule sets,combining with feedback of the rule matching frequency,rule matching order is renewed and the sizes of active rule sets are limited in real time,so the rule matching speed can be improved.