Optimization methods of GIDS packet classification using dynamic traffic characteristic

Traditional packet classification algorithms in Giga bit Intrusion Detection System (GIDS) always focus on static characteristic of the signature and ignore the traffic characteristic totally. In this paper we argue that efficiency of the classification algorithm is up to how current traffic visits the tree, the more well-proportioned the classification tree could partition the traffic, the more efficient it would be. So optimization methods using dynamic traffic characteristics are exploited. Our contributions lie in three folds. Firstly, a novel best classification tree is formally defined aiming to minimize the visit cost of the traffic in the slot, based on which optimization methods are exploited. Secondly, Packet Feature Entropy is proposed to measure how efficiently a packet field can partition the traffic, and the popular 14 packet fields used in Snort are investigated in detail by 10Gbps backbone trace and Netflow data. Finally, adaptive updating strategies are discussed by analyzing the experiment results.