Fast Packet Classification for Snort by Native Compilation of Rules

Download Now Free registration required

Executive Summary

Signature matching, which includes packet classification and content matching, is the most expensive operation of a signature-based Network Intrusion Detection System (NIDS). This paper presents a technique to improve the performance of packet classification of Snort, a popular open-source NIDS, based on generating native code from Snort signatures. An obvious way to generate native code for packet classification is to use a low-level language like C to access the contents of a packet by treating it as a sequence of bytes. Generating such low-level code manually can be cumbersome and error prone. Use of a high-level specification language can simplify the task of writing packet classification code.

  • Format: PDF
  • Size: 102.7 KB