Network communication quintuple fast matching algorithm based on improved automatic state machine

Abstract

The invention discloses a network communication quintuple (a source IP, a target IP, a source port, a target port and a protocol number) fast matching algorithm based on an improved automatic state machine. According to the algorithm, a quintuple unit dividing module, a mixture automatic state machine module, an asterisk wildcard mapping module and a matching rule calculating module are adopted, wherein the quintuple unit dividing module is used for establishing a mismatching collision domain, the mixture automatic state machine module is used for achieving uniform matching of point data and section data, the asterisk wildcard mapping module is used for solving the asterisk wildcard matching problem in matching, and the matching rule calculating module is used for reducing redundancy operation caused by asterisk wildcard mapping. The algorithm is characterized in that static parameters in the quintuple are extracted as mush as possible to establish an ordinary automatic state machine, and a larger collision domain is established; for section type parameters, a chain table is added behind the automatic state machine, a mixture automatic state machine structure is formed, and supporting for the section type parameter matching is achieved; the asterisk wildcard matching problem is solved through asterisk wildcard mapping, a replacement rule is precisely matched, and the amount of redundancy calculation is reduced. The algorithm can be widely applied to an intrusion detection system, a network blacklist and whitelist library, a network data analyzing product and other products.

Description

technical field [0001] The invention belongs to the field of network communication, in particular to a network communication five-tuple fast matching algorithm based on an improved automatic state machine. Background technique [0002] With the development of computer science and technology, especially the development of Internet technology, network communication technology has become more and more important. In network communication technology, the source information and destination of communication between communication entities are generally monitored by comparing the consistency of network communication information (network communication quintuples, namely source IP, source port, destination IP, destination port, protocol number). information, and then judge whether it is abnormal. Especially in the field of intrusion detection and defense, the system needs to configure some network communication blacklist databases (rule databases) or whitelist databases to monitor the...

AI Technical Summary

Problems solved by technology

In this way, although the time efficiency of matching can be significantly improved, it will further highlight the defect that the multi-pattern matching algorithm consumes too much memory

Images