Project

General

Profile

Actions
Copy link

Task #3302

open

Research: ruleset optimizations

Added by Andreas Herz over 4 years ago. Updated over 4 years ago.

Status:
New
Priority:
Normal
Assignee:
Community Ticket
Target version:
TBD
Effort:
Difficulty:
Label:

Description

The suggestion at Suricon 2019 was to have an analyzer that inspects a ruleset and compiles it into a more optimized form.

An example: if there are many similar rules for matching a DNS query, perhaps this logic could automatically convert this into a single rule + a dataset.

The purpose of this ticket is to research what those optimizations could be and test if they actually improve performance.

Related issues 1 (1 open — 0 closed)

Related to Suricata - Task #3288: Suricon 2019 brainstormAssignedVictor JulienActions
Actions
Copy link
 #1

Updated by Victor Julien over 4 years ago

  • Description updated (diff)
Actions
Copy link
 #2

Updated by Victor Julien over 4 years ago

  • Assignee changed from OISF Dev to Community Ticket

I think it would be great if some test cases could be built, and then tested against pcaps and replay.

E.g. 1000 dns rules vs 1 dataset rule.

Perhaps we can ask Brad to use his replay setup to test the results.

Actions
Copy link
 #3

Updated by Victor Julien over 4 years ago

  • Parent task deleted (#3288)
Actions
Copy link
 #4

Updated by Victor Julien over 4 years ago

  • Related to Task #3288: Suricon 2019 brainstorm added
Actions
Copy link

Also available in: Atom PDF