Translating Snort rules to STATL scenarios

摘要: The number of intrusion detection systems (IDSs) is large and growing. Most IDSs are signature based, which means that they include signatures for some collection known attacks, monitor an event stream looking instances any in their collection. There enormous duplication effort within the IDS community, as each newly discovered attack requires independent specification IDS. Sharing collections has obvious advantages community a whole, mainly by (1) allowing better allocation scarce resources (developers researchers) (2) supporting peer review collections, can lead to detectors. Snort with published signatures. This paper considers automated translation rules STATL scenarios. Automatically translating scenarios practical effect use Snort’s NetSTAT sensors, essentially no new work developed. A snort2statl translator been developed implements described scheme. signaturespecifying elements rule language easy translate STATL, but developing scheme its implementation, then complete set standard into scenarios, raised few issues discussed.