Set-Based Calculation of Topological Relations between Snort Rules
Расчёт топологических отношений между правилами Snort на основе теории множеств
2014-12-01
SCID: 54.1/h477auqc
Discuss with AI
Snort rulesalert redundancyintrusion detection systemsset theorytopological relations
Figures from the paper
Abstract (AI)
Snort is the most popular Intrusion Detection Systems (IDS). It will generate alert messages when an arrival packet matches some of the pre-defined rules. Snort has some problems as follows: it tries the matching for all of the rules even when the packet never matches some rules in case of matching some other rules, and it provides contradictory and redundant alert messages when a set of erroneous and poorly-organized rules is given. This paper proposes a method for characterizing relations between Snort rules towards the solutions for the above problems. The proposed method calculates topological relations between Snort rules based on a set theory.
Key Findings
1
Erroneous or poorly organized Snort rules can produce contradictory and redundant alert messages.
2
Snort may test packets against all predefined rules even when matching one rule makes other rule evaluations unnecessary.
3
The paper proposes characterizing relations between Snort rules to support more efficient matching and reduce conflicting or redundant alerts.
4
Topological relations between Snort rules are calculated using set theory.
Research Object
Snort rules
Research Subject
topological relations between Snort rules, including their characterization to identify redundant and contradictory rules and avoid unnecessary matching
Publication Details
Publication Date
2014-12-01
Journal
Publisher
ISSN
Access Type
Author Information
Download PDF
Subscribe to digest