A parallel network flow feature detection method and system based on pattern clustering

Abstract

The invention discloses a parallel network flow feature detection method based on pattern clustering, comprising the steps of: selecting a pattern matching algorithm set, selecting a pattern length segmentation point, and dividing the pattern set into a short pattern set and a long pattern set; Divide the long pattern set into multiple long pattern subsets, determine the number of processing units of the short pattern set and the long pattern subset; copy the number of copies of the text to be detected as the total number of copies of the long and short pattern subsets, and divide each copy to be tested The text is input into the processing unit corresponding to each pattern subset; combined with the processing results of each pattern subset, it is judged whether there is an attack pattern in the text to be detected; the above steps are repeated to continuously detect the data stream transmitted by the fast network stream to be detected. This method can be applied to various levels of performance requirements and pattern sets of various scales, and has extremely far-reaching effects on systems such as high-performance content detection, intrusion detection, virus protection, unified threat management, and network information monitoring.

Description

technical field [0001] The invention relates to the technical field of network flow content detection, and in particular to a method and system for detecting parallel network flow characteristics based on pattern clustering. Background technique [0002] As the Internet has become one of the main infrastructures of today's society, malicious attacks on the integrity, privacy, and availability of data streams on the Internet are also increasing rapidly. As the most extensive network security device, the main function of the firewall is to judge whether the network data packet is authorized access according to each field of the network data packet header, and then decide whether to allow the network data packet to pass. However, the increase of network attack modes and the diversification of forms make it impossible to meet the needs of attack prevention only by detecting the header part of network data packets. The feature detection of the network data packet load part has be...

AI Technical Summary

Problems solved by technology

In Network Intrusion Prevention System (NIPS) and Unified Threat Management System (UTM), due to the need to detect attack patterns in real time and give processing results, the speed of signature detection methods has become a serious bottleneck limiting the processing throughput of devices

[0005] Although the system solution based on ASIC and FPGA has certain advantages in processing speed, its high cost and poor flexibility limit the application of feature detection methods.

Images