Data flow detection method and device

Abstract

The invention provides a data flow detection method and a data flow detection device. According to the data flow detection method and the data flow detection device, rules finally matched with a data flow are filtered, and the final remaining rules are less than the rules finally matched with the data flow, namely, the number of times of carrying out regular expression matching on the data flow finally is reduced, the performance overhead of equipment on regular expression matching is greatly decreased, and the processing bandwidth of the data flow detection equipment is broadened on the premise that hardware is unchanged.

Description

technical field [0001] The present application relates to network communication technology, in particular to a data flow detection method and device. Background technique [0002] Currently, a device used for data flow detection in the application layer (abbreviated as a data flow detection device) detects data flow in the application layer based on a detection rule base. The data flow detection device here is, for example, an Internet behavior management device, an intrusion detection device (IPS), and the like. [0003] The rules in the detection rule base mainly define the following matching conditions: [0004] Fixed string: There are one or more fixed strings, one or more of which need to be hit; [0005] Protocol: specific protocols such as UDP, HTTP, etc.; [0006] Direction: the request method of the data flow or the response direction, or bidirectional; [0007] Port: data flow source port or destination port information, most rules do not define ports; [0008...

AI Technical Summary

Problems solved by technology

[0009] Usually, the above matching conditions cannot accurately detect the data flow for most applications. Therefore, in addition to defining the above matching conditions, one or more regular expressions need to be defined in the rule. When the above matching After the conditions are met, the regular expression is matched. When the regular expression also hits, it means that the rule is accurately hit.

[0010] However, it consumes a lot of performance when performing regular expression matching. When the data flow detection device performs application layer data flow detection, it will consume a lot of device performance due to regular expression matching, resulting in defects such as data flow forwarding delays.

Images