Rapid network flow feature detecting method based on layering hop index

Abstract

The invention relates to a fast network flow feature detection method based on a hierarchical jump index, and belongs to the technical field of network flow content detection. Firstly, for two blocks with a specific length at a specific position in the pattern set that identifies network flow characteristics set by the user, two block skip tables are respectively established; the first block between the two block skip tables and the pattern , the second mapping table, through the "bit AND" operation, obtain the third mapping table, establish a deep jump table according to the third mapping table, and finally establish a potential matching table; according to the established three tables, the data flow transmitted by the fast network flow Perform continuous testing. The detection method of the present invention reduces unnecessary comparison operations in the detection process by digging deeply into the heuristic information in the pattern set. At the same time, the hierarchical tabular data structure is used to make the performance of the method stable and the search speed fast. It is suitable for high-performance firewall, content detection, intrusion detection, virus protection and network information monitoring and other fields.

Description

technical field [0001] The invention relates to a fast network flow feature detection method based on a hierarchical jump index, and belongs to the technical field of network flow content detection. Background technique [0002] In recent years, malicious attacks on the integrity, privacy, and availability of data streams on the Internet have grown rapidly, which has promoted the development of technologies such as firewalls, virtual private networks, and network intrusion detection systems (NIDS) and network intrusion prevention systems (NIPS). develop. In order to prevent these attacks, on the basis of protocol analysis and state analysis, a very important part of the network equipment is to detect whether the load of the network packet contains a characteristic string identifying misuse and attack by using a multi-pattern matching method (i.e. model). [0003] Multi-pattern matching methods mainly study techniques for quickly matching multiple patterns from large amount...

AI Technical Summary

Problems solved by technology

At present, there are no good solutions for network information monitoring, intrusion detection systems, and intrusion prevention systems with bandwidths above gigabit

Images