Research on Rapid Detection Algorithm Based on Property Choosing Tree

摘要：

The construction method used by detection engine Snort-NG based on ID3 decision tree has the problem of excessive memory occupancy. The idea that the test properties are chosen according to the gradation of rule property in network protocol stack was presented in this paper; that is, the property of link layer first determined, and then network layer and transport layer. The atomicity of the value of these properties were preserved and the values of these properties were treated as a whole. The results of experiment showed that the occupancy of memory was much less in the state of non-trivial property being very common with this approach.)

关键词： ID3 Rule property Protocol stack

作者: Nengshan Feng Yugang Wu Zhongming Yang Huomin Liang

作者单位: School of Computer Science & Technology Dongguan University of Technology Dongguan,Guangdong,China School of Computer Science and Engineering Jiang Su University of Science & Technology Zhenjiang,Jia School of Science Guangdong University of Petrochemical Technology Maoming .Guangdong,China School of Software Engineering SouthChina University of Technology Guangzhou,Guangdong,China

会议类型: 国际会议

会议名称: 2011 3rd International Conference on Computer and Network Technology(ICCNT 2011)(2011第三届IEEE计算机与网络技术国际会议)

会议地点: 太原

会议语种:英文

页码: 521-524

在线出版日期: 2011-02-26（万方平台首次上网日期，不代表论文的发表时间）