Improvement on rules matching algorithm of snort based on dynamic adjustment

Abstract

With the increasing network security accidents, intrusion detection systems (IDS) have been an indispensable part of information system. As a popular light network intrusion detection system, Snort has been a focus in research field. In this paper, dynamic adjustment algorithm is applied to the improvement of rule matching based on the analysis of original mechanism of Snort. Additionally, further optimization is discussed against the problem of simple dynamic adjustment, and improved two step dynamic rule adjustment algorithm is provided. Experiment results show that this method increases the speed of rules matching and improve the detection efficiency of Snort.