Performance optimization of Snort based on DPDK and Hyperscan

Snort is an open source, lightweight and widely used intrusion detection system. The detection rules are the core of Snort’s detection capabilities. Snort captures and checks in real time whether the data packets meet the traffic characteristics described by a certain detection rule and triggers an alarm if it matches. Due to the insufficient packet capture capability and the performance defects of the detection engine module of Snort. It is difficult to process all arriving data packets in real time when Snort uses a large number of detection rules to process high-speed network traffic. And then it results in a high false negative rate. In this paper, we first analyzed the architecture of Snort and proposes that the key to reducing the false negative rate under high-speed network traffic is to improve Snort’s packet capture capability and the performance of the detection engine module. In order to improve the performance of packet capture module of Snort, we design and implement the Snort DAQ module based on the high-performance packet processing framework DPDK. The high-performance regular engine Hyperscan is integrated into Snort in order to optimize detection engine module. Experiments show that Snort’s packet capture capability and the detection rate of malicious traffic under high-speed network traffic have been greatly improved after optimization.