论文部分内容阅读
针对Snort规则间的相互关系难以把握的问题,基于集合理论对Snort规则间的拓扑关系进行了分类,并提出了Snort规则间拓扑关系的计算方法.在已有的Snort规则相互关系分析方法中,通常只根据Snort规则的头部信息来决定整条规则之间的相互关系.所提方法在不考虑Snort规则动作的情况下,对已有的方法进行了改进,能够同时根据Snort规则的头部信息和选项部分的取值来分类和计算整条Snort规则之间的拓扑关系.另外,使用函数式编程语言Haskell实现了所提方法.实验结果表明,该方法能够快速有效地计算出Snort规则间的拓扑关系,并且能为后续的Snort规则间的冲突检测提供重要的依据.
According to the problem that the interdependence between Snort rules is not easy to be grasped, the topological relations between Snort rules are classified based on set theory, and the method to calculate the topological relations between Snort rules is proposed.In the existing Snort rule correlation analysis methods, The relationship between the whole rule is usually decided only according to the header information of Snort rule. The proposed method improves the existing method without considering the action of Snort rule, and at the same time, Information and options part of the classification and calculation of the topological relationship between Snort rules.In addition, the use of functional programming language Haskell achieved the proposed method.The experimental results show that the method can quickly and efficiently calculate the Snort rules And can provide an important basis for the conflict detection between the following Snort rules.