Pattern clustering-based parallel network flow characteristic detection method

Abstract

The invention discloses a pattern clustering-based parallel network flow characteristic detection method, which comprises the following steps: selecting a matching algorithm set of patterns, selecting length dividing points of the patterns and dividing a pattern set into short pattern subsets and long pattern subsets; determining the number of processing units for processing the short pattern subsets and the long pattern subsets; copying a number of texts to be detected and inputting each text to be detected into the corresponding processing unit of each pattern subset respectively, wherein the number of the copied texts is equal to the total number of the long and short pattern subsets; in combination with the processing results of each pattern subset, judging whether an attack pattern exists in the texts to be detected or not; and repeating the steps to continuously detect data traffic transmitted by a quick network flow to be detected. The method is an extensible total solution for network flow characteristic detection, can be applied to various levels of performance requirements and the pattern sets of various scales, and is of profound value for systems for high-performance content detection, intrusion detection, virus protection and unified threat management, network information monitoring and the like.

Description

technical field [0001] The invention relates to the technical field of network flow content detection, in particular to a parallel network flow feature detection method based on pattern clustering. Background technique [0002] As the Internet has become one of the main infrastructures of today's society, malicious attacks on the integrity, privacy, and availability of data streams on the Internet are also increasing rapidly. As the most extensive network security device, the main function of the firewall is to judge whether the network data packet is authorized access according to each field of the network data packet header, and then decide whether to allow the network data packet to pass. However, the increase of network attack modes and the diversification of forms make it impossible to meet the needs of attack prevention only by detecting the header part of network data packets. The feature detection of the network data packet load part has become an important part of n...

AI Technical Summary

Problems solved by technology

In Network Intrusion Prevention System (NIPS) and Unified Threat Management System (UTM), due to the need to detect attack patterns in real time and give processing results, the speed of signature detection methods has become a serious bottleneck limiting the processing throughput of devices

[0005] Although the system solution based on ASIC and FPGA has certain advantages in processing speed, its high cost and poor flexibility limit the application of feature detection methods.

Images