Abstract: According to the network environment constant change and rule classification asymmetry, we developed a high efficient detection method, considering the characteristics of both rules and loads. The method could dynamically generate a rule-matching tree, which adapted the payload features. Then we implemented it over Snort. The experiment results show that using the method, we can not only solve the problem of Network Intrusion System’s high packet loss rates, but also greatly reduce the rule set of each packet or event needs detection. Thus, the detection efficiency will be improved.

Key words: intrusion detection, payload, rule, network intrusion detection system