Patent ID: 7904942

Claim:
A method of updating intrusion detection rules through a link data packet, adapted to dynamically update a rules storage adopted by at least one Snort system host in a local area network (LAN), comprising: an update sponsor transmitting the link data packet with at least one intrusion detection rule to Snort system host(s); the Snort system host(s) acquiring the intrusion detection rule(s) from the received link data packet, and parsing an operation type of the intrusion detection rule(s); the Snort system host(s) verifying an validity of the intrusion detection rule(s) in the link data packet; updating the rules storage according to the type of the intrusion detection rule(s) passing the verification and a rules tree; and wherein the number of items for the intrusion detection rules in the link data packet is set according to a network scale and a network flow of the LAN, and preset time needed for updating.