Increasing Performance in High Speed NIDS is a paper discussing a number of methods to increase performance in Snort and also NIDS in general. Discusses bottlenecks that Snort has, a brief history of snort pattern matching, and the work that Silicon Defense did with Aho-Corasick_Boyer-Moore, discussing the differences between network grep and protocol analysis.
You can download it from the following link: https://packetstormsecurity.com/files/download/25870/Increasing_Performance_NIDS.pdf
Source: https://packetstormsecurity.com/files/25870/Increasing_Performance_NIDS.pdf.html