Mode matching method facing to high speed network

Abstract

The invention discloses a method for matching mode facing a high-speed network. The method comprises the following steps: a computer extracts a characteristic value for each data flow attacking a network and compiles the data flow to a rule model according to rule language; in network communication, the computer matches a captured data packet and the rule model by a detecting system; if matching succeeds, the detecting system determines the captured data packet as an attack action. The matching step of the invention is combined with the existing BM method to realize innovation from the two aspects of comparing ways and moving strategy, thereby greatly improving matching efficiency. The method is applicable in quick character matching fields which require network invasion detection, network invasion protection, computer virus condition code matching and the like under high-speed network environment.

Description

technical field

[0001] The invention relates to a character string pattern matching method, which is suitable for applications in fields requiring character matching, such as network intrusion detection, network intrusion protection, and computer virus feature code matching in a high-speed network environment. Background technique

[0002] At present, there are many pattern matching methods, and the most widely used one is the pattern matching method based on the principle of BM method. The BM pattern matching method is an exact single matching method, which uses a heuristic strategy to skip unnecessary comparisons to reduce the number of comparisons between pattern strings and text to improve matching efficiency. When matching, align the pattern string with the left end of the text, and compare characters one by one from the right end of the pattern string to the left. In the initial stage, match the suffix of the pattern string with the text. After completing an attempt (...

Images