A quality metric for IDS signatures: in the wild the size matters

EURASIP Journal on Information Security

Table 5 Comparison of good and regular Snort signatures

	Bytes checked	Fields checked	Byte offset is set	Regular exp. is set	Regular exp. size	Destination port is set	Packet size is set	Flow options are set	IP options are set
Regular signatures	11.2	1.2	8%	15%	4.2	17%	6.9%	30.2%	62.1%
Good signatures	23.2	2.4	28%	51%	11.3	22%	14.5%	38%	68.4%
Increase	2.1 ×	2 ×	3.5 ×	3.4 ×	2.7 ×	1.3 ×	2.1 ×	1.8 ×	1.1 ×