Method and device for reducing network security scanning rule set

Abstract

A method and device for reducing a network security scanning rule set relate to the field of information technology. The invention is composed of a rule classifier, a classification rule temporary register, a character string extractor, a regular expression extractor, a character string mapping rule set and a regular expression mapping rule set. The present invention performs secondary conversion processing on text rules: reads rule files to perform field analysis, extraction, sorting, clustering, and output. Reload the output fields, and use a one-time matching algorithm or a clustering matching algorithm to perform the matching process to improve the low efficiency of rule matching one by one.

Description

technical field [0001] The present invention relates to the field of information technology. Background technique [0002] A rule scanning engine is a component embedded in an application that separates business decisions from application code and writes business decisions using predefined semantic modules. The specific execution can be divided into several processes of accepting data input, interpreting business rules, and making business decisions according to business rules. Using the rule scanning engine can separate complex and redundant business logic from the application support system to achieve reusable portability of the system architecture. Rule scanning engines typically allow users to adjust rules without restarting the system or deploying new executable code, thereby enabling changes in business processing capabilities. The rule scanning engine is intended to be a tool that provides a higher level of abstraction so that users can focus less on development det...

AI Technical Summary

Problems solved by technology

[0008] 4) Match by packet / stream: packet - match by single packet, stream -- match by flow, this configuration is not effective at present;

[0026] The main customers of the detection engine are communication operators. The traffic monitoring equipment deployed by the operators has a large access traffic and the rules for malicious code detection are highly complex. Emphasis on the network security situation, further strengthening of network security supervision, the number of rules will further increase, and the performance of sequential matching and pattern matching is low, so the detection engine has become the performance bottleneck of network security monitoring;

[0027] (2) Portability issues:

[0028] Hyperscan is a high-performance regular expression matching engine library provided by Intel. It can only be used on the x86 hardware platform, and cannot be used on ARM, MIPS, PowerPC and other platforms, so the portability of the detection engine is limited.

Images