Quick Signature Scan

Abstract

A method and system for scanning a signature on a string field. In one embodiment, the present invention provides a feature code scanning method. The method includes processing the one or more signatures into one or more formats including one or more fingerprints and one or more subsequent lookup data structures for each fixed-length signature or signature subkey, whereby Make the number of fingerprints of each fixed-length signature or signature subcode equal to the step size of the signature scan operation, and make the specific fixed-length signature or signature subcode at any position in any scanned string field can be identified, receive a specific string field, and identify any signatures included in the specific string field, including scanning the fingerprint at each position with a scan step as the interval, and when there are one or more The subsequent lookup data structure is looked up at the locations of matching fingerprints, and any identified signatures are output.

Description

technical field [0001] The present invention relates to scanning a signature in a character string field. Background technique [0002] An object of digital content (such as a file, program, web page, email, Internet packet, or digital image) can contain one or more string fields. A string field is a string of data values ​​that usually represent text or executable code. For example, an Internet packet can contain URLs, hostnames, Hypertext Transfer Protocol (HTTP) headers, HTTP packets, email attachments, email headers, and email content. A string field can range in size from a few bytes to millions of bytes. A string signature can be a string of specific fully specified data values ​​or an expression of specific data values ​​(such as a specific regular expression), whose purpose is to identify a string object (such as a specific computer virus or a specific gene sequence). Signatures can be stored in a signature database. A character code database can contain multipl...

AI Technical Summary

Problems solved by technology

Scanning speed is usually limited by the size and complexity of signatures

Additionally, scan speed is limited by the ability to update signatures one by one

Images