Rule compiling and matching method and device

Abstract

The embodiment of the invention provides a rule compiling and matching method and device, and relates to the field of computers. When network data stream rules are matched, traversal matching does not need to be carried out on all the rules, the number of the rules needing to be matched is reduced, and the searching and matching efficiency is effectively improved. According to the specific scheme, data to be matched are acquired firstly, application identification is carried out on the data to be matched according to protocol types and port types corresponding to the data to be matched, then a corresponding sub-rule tree is determined in a rule tree, the characteristic element types of a plurality of characteristic elements included in the data to be matched are determined, corresponding rule subsets are acquired from the sub-rule tree according to the characteristic element types, and finally the data to be matched are matched according to rules including in the rule subsets. The method and device are used for intrusion detection.

Description

technical field [0001] The embodiments of the present invention relate to the field of computers, and in particular to a method and device for compiling and matching rules. Background technique [0002] With the widespread use of computers and networks, the means of attack from network security threats are gradually becoming more and more complex, and it is becoming more and more important to ensure computer and network security. [0003] Intrusion detection can actively discover attacks and protect in real time, and plays an important role in computer network security. The rule compilation and matching mechanism adopted by the open source intrusion detection and protection system represented by Snort is roughly as follows: generate a rule tree according to the detection rules, where the detection rules It consists of a set of feature elements with logical relationships. The feature elements are pattern strings defined in applications such as intrusion detection, anti-virus,...

AI Technical Summary

Problems solved by technology

When Snort builds the rule tree, it divides all detection rules into Internet Protocol (Internet Protocol, IP), Transmission Control Protocol (Transmission Control Protocol, TCP), User Datagram Protocol (User Datagram Protocol, UDP) and Internet Control Message Protocol (Internet Control Message Protocol, ICMP) four main nodes, and then the detection rules are correspondingly stringed on the four main nodes in the form of a linked list, and after capturing the network data flow, match the IP, TCP, UDP or ICMP, after matching one of the four main nodes, it traverses all the rules in the corresponding linked list from the head of the linked list in sequence. Therefore, Snort consumes a lot of time in matching and detecting network data streams. time

Images