Method and apparatus for filtrating data content, finite state automata and conformation apparatus

Abstract

The invention discloses a method for filtering data content and a device thereof, a finite state automata and a structure device thereof, wherein, the method comprises the steps as follows: the finite state automate receives a data message; the finite state automata is constructed and generated by subcharacter codes which are obtained by decomposing condition codes; the finite state automata processes the received data message and all subcharacter codes used for constructing and generating the finite state automata for match query and outputs the query result; and according to the query result, when the data message is the same as one subcharacter code with the condition code being more than the preset value, wherein, the subcharacter code is used for forming and generating the finite state automata, the data message is intercepted. The embodiment of the invention can filter suspected virus and avoids the network safety threat from the suspected virus under the condition of not increasing the storage capacity of a condition code base and the spending and time required for searching the condition code base.

Description

technical field [0001] The invention relates to a data content filtering technology, in particular to a data content filtering method and device, a finite state automaton and a construction device thereof. Background technique [0002] Aho-Corasick algorithm is an efficient multi-keyword matching algorithm. When using the Aho-Corasick algorithm for keyword matching, first construct three functions: GOTO, FAILURE and OUTPUT functions, and then use these three functions to construct a finite state automaton (Deterministic Finite State Automaton, hereinafter referred to as : DFA). Each character in the searched feature code library is input into DFA one by one, and when a query keyword is hit, DFA will output a search result report. [0003] The Aho-Corasick algorithm is introduced below by taking the worm filtering of the network firewall as an example. Assume that there are 4 worms whose signature codes are: HE, SHE, HIS and HERS. The DFA of a network antivirus wall const...

AI Technical Summary

Problems solved by technology

[0013] However, the existing Aho-Corasick algorithm only supports exact matching, that is, it can only query the virus that exactly matches the signature in the searched signature database according to the signature database and the constructed DFA, but cannot find the virus that matches the searched signature. The feature codes in the code library approximately match the suspected virus, therefore, according to the existing Aho-Corasick algorithm, the security threat of the suspected virus to the network cannot be avoided

If it is necessary to avoid the threat of suspected viruses to network security based on the existing Aho-Corasick algorithm, it is necessary to enter all the signatures of suspected viruses into the signature database and construct a DFA based on this, and then perform signature database search and virus analysis based on the constructed DFA. Matching, which undoubtedly increases the storage capacity of the signature library, and increases the overhead and time required to search the signature library

Images