|
Snort 2.0 - Detection Revisited |
|
|
|
Source: Sourcefire - Posted by Nick DeClario
|
Sourcefire's commitment to delivering the most innovative and effective intrusion management solutions continues with the latest contribution to Snort 2.0 development. As part of Sourcefire's dedication to the Open Source community, the company continually upgrades Snort with technologies and enhancements developed . . .
Sourcefire's commitment to delivering the most innovative and effective intrusion management solutions continues with the latest contribution to Snort 2.0 development. As part of Sourcefire's dedication to the Open Source community, the company continually upgrades Snort with technologies and enhancements developed for its commercial products. These enhancements provide users with increased accuracy and up to 18 times greater performance than previous versions. Snort 2.0 has been reengineered to use a new HTTP Protocol Flow Analyzer and Detection Engine. The Flow Analyzer optimizes data flow by reducing unnecessary data inspections while the Detection Engine uses a fast set-based rule selection methodology and a high performance multi-pattern search engine. The multi-pattern search engine uses a two-stage architecture to inspect data and find rule matches. The first stage of the multi-pattern search engine is a high-speed set-based inspection engine, which quickly identifies potential rule matches based on content and ports. The second stage is an enhanced rule processing engine, which provides additional functionality for in-depth validation of potential rule matches. Together, these enhancements greatly improve the performance and efficiency of Snort and help to reduce false alarms. The Protocol Flow Analyzer classifies network application protocols into client and server data flows. In-depth analysis of these protocol data flows allows Snort to make intelligent decisions about protocol inspection.
Read this full article at Sourcefire
Only registered users can write comments.
Please login or register. Powered by AkoComment! |
