Patent ID: 7305708
Filing Date: 2007-12-04
Classification: H04L

Abstract:
1. A method for optimizing rules in an intrusion detection system, comprising: creating a plurality of different rule sets from a plurality of intrusion detection system rules, including combining only one or two unique rules with all generic rules for the same transport protocol to form unique rule sets, and combining all generic rules for the same transport protocol to form generic rule sets, wherein each intrusion detection system rule in the unique rule sets or generic rule sets is for a same transport protocol, wherein the only one or two unique rules specify parameters in a transport header or an IP header which are different from parameters of every other rule, wherein generic rules specify content but not parameters in a transport header or an IP header, wherein each rule set indicates a combination of parameters of the combined rules; determining at least one rule set that matches each packet by comparing parameters but not the content of the packet to the indicated combination of parameters of the at least one rule set; and inspecting the content and parameters of the packet with only the intrusion detection system rules in the at least one rule set that matches the packet.