NIDS - substitute illegal chars, improved some rules