Re: snort signature analysis tools

[Jose Nazario <jose () monkey org>]

On Tue, 18 Jan 2005, Chris Green wrote:

> It's non-trivial to write such an application but I think it would make
> a really good project for a Comp Sci person since being able to group
> the rules into overlaps would be right on the boundary of IDS
> performance grouping without the need for expensive testing hardware.

as you might expect, this has already been done:

        http://compilers.iecc.com/comparch/article/98-08-060
        http://www.cs.ucsd.edu/groups/tatami/bobj/rexp.html

etc ...

________
jose nazario, ph.d.                     jose () monkey org
http://monkey.org/~jose/                http://infosecdaily.net/

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------