| This paper studies the packet classification algorithms as well as its applicationon intrusion detection tool Snort and data stream detection which based on thestateful packet classification. However, Internet users have increased drastically, anda variety of network services are emerging, resulting in the rapid growth of thenetwork data stream, which put forward new demands of various network devices,differentiated services mechanisms such as resource reservation services, networkquality of service, virtual private network and so on. Packet classification, which isthe basis of technology to provide differentiated services, has an extremelyimportant significance to the future development of the Internet.This paper studies the packet classification algorithms at first. For the slowinitialization speed of the recursive flow classification algorithm which is currentwidespread used, two improved algorithms are presented. By reducing theredundancy in the system initialization process, the first improved algorithm betterthe initialization performance of recursive flow classification algorithm; the secondimproved algorithm makes the detection system initialization faster more significantby doing some pre-operation to the classification rules set, which further reducingredundant operation of the algorithm. Then, this paper studies the Snort, which is themost famous and most widely used open source intrusion detection tool. In order toimprove the packet inspection rate of Snort, recursive flow classification algorithmis applied to the Snort. Through recursive flow classification algorithm to quicklyidentify all detection rules which matched with the current packet, replacing thedetection process that Snort detect packet with linear matching all detection rules,and it effectively improve the detection speed of Snort. Finally, this paper presents akind of detection system which based on stateful packet classification for gateway.By extracting critical information of a packet, the new system maps a packet to acharacter, and it achieves the detection of data flow through the detection of themapping string. It is not only simplifying the session information table managementof status detection system, but also improving the packet detection efficiency, whichgreatly enhance the performance of the system. |
