Data flow detection method and device

Abstract

The invention provides a data flow detection method and a data flow detection device. According to the data flow detection method and the data flow detection device, rules finally matched with a data flow are filtered, and the final remaining rules are less than the rules finally matched with the data flow, namely, the number of times of carrying out regular expression matching on the data flow finally is reduced, the performance overhead of equipment on regular expression matching is greatly decreased, and the processing bandwidth of the data flow detection equipment is broadened on the premise that hardware is unchanged.

Description

Technical field [0001] This application relates to network communication technology, and particularly relates to a data stream detection method and device. Background technique [0002] Currently, a device used for data flow detection in the application layer (referred to as a data flow detection device) detects the data flow of the application layer based on a detection rule library. The data flow detection equipment here is, for example, Internet behavior management equipment, intrusion detection equipment (IPS), etc. [0003] The rules in the detection rule library mainly define the following matching conditions: [0004] Fixed string: There are one or more fixed strings, one or more of them must be hit; [0005] Protocol: specific protocols such as UDP, HTTP, etc.; [0006] Direction: The request method of the data stream is the response direction, or two-way; [0007] Port: data flow source port or destination port information, most rules do not define ports; [0008] Position: The...

AI Technical Summary

Problems solved by technology

[0009] Usually, the above matching conditions cannot accurately detect the data flow for most applications. Therefore, in addition to defining the above matching conditions, one or more regular expressions need to be defined in the rule. When the above matching After the conditions are met, the regular expression is matched. When the regular expression also hits, it means that the rule is accurately hit.

[0010] However, it consumes a lot of performance when performing regular expression matching. When the data flow detection device performs application layer data flow detection, it will consume a lot of device performance due to regular expression matching, resulting in defects such as data flow forwarding delays.

Images