Snort rule parsing