Rule indexing for efficient intrusion detection systems
- Authors
- Kang, Boojoong; Kim, Hye Seon; Yang, Ji Su; Im, Eul Gyu
- Issue Date
- Aug-2011
- Publisher
- Springer Verlag
- Keywords
- indexing; intrusion detection system; Network security; pattern matching; Snort
- Citation
- Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), v.7115 LNCS, pp.136 - 141
- Indexed
- SCOPUS
- Journal Title
- Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
- Volume
- 7115 LNCS
- Start Page
- 136
- End Page
- 141
- URI
- https://scholarworks.bwise.kr/hanyang/handle/2021.sw.hanyang/167811
- DOI
- 10.1007/978-3-642-27890-7_11
- ISSN
- 0302-9743
- Abstract
- As the use of the Internet has increased tremendously, the network traffic involved in malicious activities has also grown significantly. To detect and classify such malicious activities, Snort, the open-sourced network intrusion detection system, is widely used. Snort examines incoming packets with all Snort rules to detect potential malicious packets. Because the portion of malicious packets is usually small, it is not efficient to examine incoming packets with all Snort rules. In this paper, we apply two indexing methods to Snort rules, Prefix Indexing and Random Indexing, to reduce the number of rules to be examined. We also present experimental results with the indexing methods.
- Files in This Item
-
Go to Link
- Appears in
Collections - 서울 공과대학 > 서울 컴퓨터소프트웨어학부 > 1. Journal Articles
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.