# Design of a Heterogeneous-Based Network Intrusion Detection System and Compiler
## Appendix A Anomaly-Based Heterogeneous Intrusion Detection
### Rule Compilation  
The Snort rule file serves as the core carrier of Snort's detection logic, achieving attack detection through defining traffic characteristics and matching conditions. Each Snort rule comprises two components: the rule header and the rule options. The basic matching format of the rule header is: [action] [protocol] [source address] [source port] [direction] [destination address] [destination port]. The \"action\" determines the response behavior after matching, including \"alert\", \"log\", \"drop\", and \"pass\"; the \"protocol\" restricts the rule to specific protocol types, typically \"tcp\", \"udp\", \"icmp\", or \"ip\"; the \"addresses and ports\" represent the source/destination IP addresses (supporting CIDR format) and source/destination ports (allowing range formats); the \"direction\" indicates traffic flow orientation, including unidirectional and bidirectional traffic. The rule options define specific detection logic in key-value pairs within parentheses, separated by semicolons. The rule options are categorized into matching conditions and metadata. Matching conditions typically include \"content\", \"pcre\", \"flow\", \"depth/offset\", and \"dsize\", used to identify specific payload strings, complex patterns, session states, search ranges, and packet sizes; metadata include \"msg\", \"sid\", \"classtype\", \"rev\", and \"reference\", providing alert descriptions, rule identifiers, attack classifications, version numbers, and external threat intelligence references. The purpose of rule compilation is to translate fields in Snort rules into data structures optimized for rapid matching, stored in memory. This enables the system to efficiently determine whether inspected data match target fields through frequent and fast lookups during anomaly detection, thereby enhancing detection efficiency. In Snort, rule compilation primarily involves rule file parsing, preprocessing, optimization, and detection structure generation. With technological advancements and algorithmic improvements, Snort has integrated the Hyperscan [31] library to achieve efficient fast-pattern matching. Leveraging multi-pattern matching, SIMD [32] acceleration, rule grouping, protocol parsing optimization, and flow state management, the system significantly improves performance for real-time traffic analysis under large-scale rule sets. Further system tuning can be applied to enhance IDS/IPS efficiency based on specific requirements. To further boost IDS throughput and adapt to multi-platform processing characteristics, numerous rule compilation studies and systems have been proposed. [PERSON] et al. [33] introduced a PCRE compiler to generate VHDL code corresponding to Snort regular expression rules for subsequent NFA-based regex engines. [PERSON] et al. [34] proposed the XAV scheme for high-performance regex matching, combining anchored DFA to address state explosion and anchor DFA with pre-filtering and regex decomposition techniques to improve average time complexity, achieving 75 Gbps matching throughput on an FPGA-CPU architecture. [PERSON] et al. [35] designed a multi-RE finite automaton that extends finite automata models by exploiting similarities in application-specific rule sets to enhance RE parallelization. The work also extended the INFAnt algorithm for MFSA execution, achieving 5.99\(\times\) throughput improvement and 4.05\(\times\) acceleration. [PERSON] et al. [36] presented Secco, a system compiling regex sets into specialized overlays, demonstrating 1.7\(\times\) and 5.9\(\times\) increases in supported regex quantities under fixed resources compared to prefix consolidation techniques through stateless transitions and pure symbolic reconfiguration on FPGA overlays. These studies predominantly focus on regex compiler design and implementation, driven by the characteristics of rules in modern intrusion detection systems.