Study And Inprovenment On Network Intrusion Detection System-Snort

With the development of computer networks, globalization of information has been becoming latest trend in human's progress. So security and safeguarding of information on computer networks has become one of the most import problems, because of the diversity of network's connection, the asymmetry of terminal's distribution ,the interconnection of computer and the attack of hacker ,cracker and vicious software .It is more important for military's automation commanding network and banks whose network communicates sensitive data .Thus we should apply sufficient safeguarding to these networks, otherwise the computer network will be useless, even jeopard the national security. Because of many natural or anthropogenic factors, the LANs and WANs are vulnerable and face many potential threats, thus safeguarding the security of the computer network becomes more and more important.Safeguarding of networks should point at all menaces, so it can ensure the secrecy, integrity, and usability of network information .As one of the important part of network security, NIDS(network intrusion detect system) shows more and more importance .Snort, a light weight NIDS, is one of them. It is capable of real time data stream analysis, IP data package logging and protocol analysis, which makes it a new hot issue in safeguarding the network security. But Snort is not perfect. It's data package analyzing ability advances much slowlier than the speed of the computer network, which results in frequent false alarm and package loss in the system. A new rule match algorithm will be proposed in this paper as a remedy. Chief work consists of system startup interface, database interface and rule matching algorithm' realization.