基于Snort的入侵检测系统的研究与改进

摘要

Intrusion detection technology is an active safety technology to protect network resources from hacker attacks, and can make up for the lack of a firewall to help the network to quickly find the occurrence of cyber attacks, and plasys an active defense role, to provide real-time instrusion detection for network security and take appropriate protective measures. This paper to improve the performance of Snort core technology undertook an analysis, put forward a kind of can effective improve the matching efficiency of AC-WM pattern matching algorithm, and the improved Snort system was tested, significantly improve the performance of system .%入侵检测技术是一种主动保护网络资源免受黑客攻击的安全技术.可以弥补防火墙的不足,帮助网络快速发现网络攻击的发生,起着主动防御的作用,为网络安全提供实时的入侵检测及采取相应的防护手段.本文对提高Snort性能的核心技术进行分析,提出一种能够有效提高匹配效率的AC-WM的模式匹配算法,并对改进后的Snort系统进行测试,显著提高了系统的性能.