Snort规则的分析与改进

Snort主要是根据规则树对数据进行递归匹配。因此,规则树的结构是否合理,在很大程度上影响着Snort规则匹配的速度。对Snort规则链表结构进行了分析,并针对Snort规则树进行改进,在保持原有规则匹配方法的基础上,使用New BM算法进行匹配,从而减少规则匹配所需时间。

Analysis and improvement of rule of snort

Snort mainly is carries on the recursion match according to the regular tree.Therefore regular tree＇s structure is whether or not reasonable will affect the Snort rule match speed in great degree.This article has carried on the analysis to the Snort regular chain table structure,and aims at the Snort regular tree to make the improvement,in the maintenance original rule match method foundation,uses New the BM algorithm to carry on the match,thus reduced the time which rule match needs.