Research and Design of Preprocessor Plugin Based on PCRE under Snort Platform

On the basis of preprocessor plugin introduced in snort platform, this paper researches and designs an Oracle preprocessor plugin based on a kind of efficient matching Perl-Compatible Regular Expressions. The main function of the plugin is to audit the database operation of Oracle client. Based on studying and analyzing the TNS protocol of Oracle, This paper discusses in detail the process of Oracle data stream in the plugin and the PCRE regular expressions which are used for matching and picking up the database name and SQL sentences. At last, the experimental result proves that the design is viable and can implement the audit of common Oracle database operations.