The invention discloses a
network communication quintuple (a source IP, a target IP, a source port, a target port and a protocol number) fast matching
algorithm based on an improved automatic state
machine. According to the
algorithm, a quintuple unit dividing module, a mixture automatic state
machine module, an
asterisk wildcard mapping module and a matching rule calculating module are adopted, wherein the quintuple unit dividing module is used for establishing a mismatching
collision domain, the mixture automatic state
machine module is used for achieving uniform matching of
point data and section data, the
asterisk wildcard mapping module is used for solving the
asterisk wildcard matching problem in matching, and the matching rule calculating module is used for reducing redundancy operation caused by asterisk wildcard mapping. The
algorithm is characterized in that static parameters in the quintuple are extracted as mush as possible to establish an ordinary automatic state machine, and a larger
collision domain is established; for section type parameters, a chain table is added behind the automatic state machine, a mixture automatic state machine structure is formed, and supporting for the section type parameter matching is achieved; the asterisk wildcard matching problem is solved through asterisk wildcard mapping, a replacement rule is precisely matched, and the amount of redundancy calculation is reduced. The algorithm can be widely applied to an
intrusion detection system, a network
blacklist and
whitelist library, a
network data analyzing product and other products.