Data matching equipment and method as well as network intrusion detection equipment and method

Abstract

The invention discloses a regular expression based data matching method for matching data on the basis of a regular expression set comprising one or more regular expressions. The method comprises the following steps of: concentratively searching one or more complex regular expressions causing state number generated on the basis of the regular expressions to quickly increase in an index way during interaction in the regular expression set; constructing a simplified expression corresponding to each complex regular expression for each of the one or more searched complex regular expressions; compiling a simplified state machine on the basis of the constructed simplified expression and other regular expressions except for the one or more searched complex regular expressions in the regular expression set; compiling one or more state submachines, wherein each of the one or more state submachines is compiled on the basis of a corresponding complex regular expression in the one or more complex regular expressions; and matching data on the basis of the simplified state machine and the one or more state submachines. The invention also discloses data matching equipment with the data matching method as well as an intrusion detection equipment and method adopting the data matching method and equipment.

Description

technical field [0001] The invention relates to the field of network security, in particular to a network intrusion detection device and method for intrusion detection, and a regular expression-based data matching device and method thereof. Background technique [0002] In the field of network intrusion detection, regular expressions are often used to detect whether malicious data in a specific format is contained in network data to determine whether a network intrusion has occurred. Because regular expressions are flexible and expressive, they are widely used in the field of network intrusion detection. [0003] In order to use regular expressions for data matching, it is usually necessary to construct a regular engine based on regular expressions. Currently, there are two kinds of regular engines, namely NFA regular engine and DFA regular engine. However, since the backtracking characteristics of NFA cannot be changed, its matching speed cannot be greatly improved. There...

AI Technical Summary

Problems solved by technology

However, this method of compressing the number of states also has certain defects: first, when the DFA state machine itself is relatively complex, the memory occupied by the additional information (state bits) introduced by this method cannot be ignored; secondly, this method The method also lacks universality. For example, this method can better solve the state expansion problem of the regular expression .*ab.*cd|.*ef.*gh, but it cannot solve the regular expression .*ab[^ The state expansion caused by \n]*cd |.*ef[^\n]*gh

However, this method has the following disadvantages, that is, the method of alphabet compression shortens the length of the state transition array, but in the process of actual state transition, it is necessary to complete the mapping between the compressed alphabet and the complete alphabet, which will Reduce the matching efficiency of the DFA state machine; and this method is only applicable to the situation where characters received from different source states can reach the same destination state, and the scope of use is very limited

Images