Decoding equipment and method aiming at structuring protocol

Abstract

The invention discloses decoding equipment aiming at a structuring protocol. The decoding equipment comprises a state setter and a state-based decoder, wherein the state setter is used for setting a decoding state for a data packet which is encoded by the structuring protocol according to a preset rule; and the state-based decoder is used for receiving the data packet of which the decoding state is set, and selecting a sub-decoder corresponding to the present decoding state of the data packet to decode a structure corresponding to the present decoding state among one or more structures of the data packet. The invention also discloses a corresponding decoding method, and a network intrusion detecting system and a network intrusion detecting method which use the decoding equipment and the decoding method respectively.

Description

technical field [0001] The invention relates to the field of computer network data communication, in particular to a decoding device and method for a structured protocol for decoding network data encoded with the structured protocol. Background technique [0002] With the development of the network, the applications based on the network are constantly enriched, so there are also various data constructed and transmitted based on the application layer protocol. Among various application layer protocols, there is a class of application layer protocols called structured protocols. SMB protocol and RPC protocol are examples of structured protocols. The characteristic of the structured protocol is that the data in the data packet encoded by the structured protocol is stored in a structured manner to form one or more structures, wherein the structure is nested in the structure or the structure is connected to the structure, and in addition , there is a strong correlation between ...

AI Technical Summary

Problems solved by technology

[0006] First of all, because the decoder generally only decodes the interested structures in the protocol data packet, it often increases or decreases the decoding of some structures in the protocol according to the needs, and because each structure in the snort application layer protocol decoder The decoding is closely related and interdependent. If you need to add or ignore the decoding of a certain structure, you need to modify more codes, which increases the maintenance cost and development risk.

[0007] Secondly, because snort's decoding method is to decode the data packet from the beginning to the end by relying on the increment of the offset, so the later decoding depends to a certain extent on the previous specific implementation, which lacks modular design and is not conducive to targeting the same decoder for parallel development

Images