A Deep Packet Inspection Method Based on Finite Automata

Abstract

The invention provides a deep massage detection method based on finite automata, and relates to the field of data messages in high-speed switching networks. The deep massage detection method based on the finite automata comprises the following steps that a CPU writes all default configurations in three-level memories in an instruction giving mode; according to preset configurations, an input data package is decomposed into a plurality of continuous character strings, each character string comprises a plurality of text information fragments, and a violation set to which each text information fragment belongs is marked; the text information fragments in the data package are detected at a constant speed through the DFA, and the violation sets to which the text information fragments belong are obtained by searching the three-level memories; the numbers of all the detected violation sets are packaged into a new data package in the set form, and the new data package is sent to the NFA; whether the various numbers, contained in the current data package, of the violation sets are allowed to coexist in the same data package is judged, if yes, the data package is forwarded normally, and if not, discarding or other types of processing are carried out. By means of the deep massage detection method based on the finite automata, related items can be combined effectively, the scale of a logic circuit is reduced, and therefore engineering realization requirements are satisfied.

Description

technical field [0001] The invention relates to the field of data messages in a high-speed switching network, and specifically relates to a deep message detection method based on a finite automaton. Background technique [0002] The Internet is the fastest-growing information technology in the 20th century. With the improvement of broadband technology and the expansion of Internet scale, the amount of Internet data is also increasing, and information security technology is increasingly becoming the core technology for ensuring national security. In the past ten years, the bandwidth of Ethernet network infrastructure has expanded from 10Gbit / s to 40Gbit / s to 100Gbit / s. Correspondingly, in order to adapt to the rapid growth of controllability and visibility based on protocols, content, and applications, network communication devices must have corresponding communication processing mechanisms. Especially from the perspective of information security, secret-related units such a...

AI Technical Summary

Problems solved by technology

If you pursue a faster detection speed, you need to expand the detection circuit as much as possible, that is to say, a larger-scale detection circuit to meet the rapidly expanding sensitive characters; but if the detection circuit area is too long, even in the most advanced 22nm process However, it is also difficult to completely make all the rules into logic circuits and integrate them on a silicon chip

Images