An Enhancement of Optimized Detection Rule of Security Monitoring and Control for Detection of Cyberthreat in Location-Based Mobile System

Table 6

Optimization of General Rules.

Command format	Selection of detection rule standardization
General	msg	Message to record when detecting
Command format	Excluded detection rules standardized/excluded reasons
General	reference	References to additional information	Excluded as an additional option for reference of detection rule information
	gid	Alert generation module id	Except for the module ID of the configuration module and the ID of the detection rule (Snort-specific function)
	sid	Use to distinguish Snort detection rules; <100 reserved number for future use; 100–1,000,000 number assigned by Snort; >1,000,000 custom rule assignment numbers
	rev	Information on revision of rules with sid	Excluded as an option for versioning of detection rules
	classtype	Information that can classify an attack	Excluded as an option for risk display and classification of detection
	priority	Significance of detection rules (top/middle/bottom)	Exclude as an option for indicating the importance of detection rules