Composite rule set matching method and system

Abstract

The present invention discloses a composite rule set matching method and system. The method comprises: using a multimode matching algorithm to process an original text obtained from a network information stream, to obtain a feature string in the original text; replacing the feature string with an identity identification number ID that is in a pre-constructed feature string rule set, and presenting the ID, with replaces the feature string, in hexadecimal; inputting the ID in hexadecimal in sequence to an automaton pre-constructed by using a pre-constructed regular expression set; and according to a jump of the automaton, obtaining a matching result between the ID and the automaton, wherein the pre-constructed feature string rule set is constructed in accordance with a preset composite rule set, and the pre-constructed regular expression set is constructed in accordance with the pre-constructed feature string. The scheme of the present invention can weaken independency between rules, reduce the number of times of repeated reading of text information and improve an actual matching speed.

Description

technical field

[0001] The invention relates to the field of network information security, in particular to a compound rule set matching method and system. Background technique

[0002] In network security, pattern matching is widely used in intrusion detection, content filtering, keyword retrieval and other fields. At this stage, due to the large network information flow and the rich content of information to be matched, the traditional single-mode and multi-mode matching cannot meet the needs well in many practical application fields. The demand for set matching problems such as "a given text needs to hit multiple feature strings at the same time, and these strings need to be compounded in a specific order" is increasing. The focus of research has changed from the traditional single-mode and multi-mode The study of matching shifts to more complex matching with compound rule sets.

[0003] At present, researchers' main research methods for compound rule matching include t...

Examples

Embodiment Construction

[0054] In order to facilitate the understanding of those skilled in the art, the present invention will be further described below in conjunction with the accompanying drawings, which cannot be used to limit the protection scope of the present invention.

[0055] The invention provides a composite rule matching method in which each sub-feature string is a partial order, which is suitable for the field of feature string matching such as network information security and text retrieval. The solution of the present invention first preprocesses the compound rule set, splits the compound rule set into two rule sets, one is a feature string rule set, each character string is obtained in the process of restoring the compound rule, and each Each feature string corresponds to a unique ID. The other is a set of regular expressions, each of which is formed by concatenating IDs corresponding to several feature strings with ".*". During the matching process, we use a two-round matching met...

technical field

[0001] The invention relates to the field of network information security, in particular to a compound rule set matching method and system. Background technique

[0002] In network security, pattern matching is widely used in intrusion detection, content filtering, keyword retrieval and other fields. At this stage, due to the large network information flow and the rich content of information to be matched, the traditional single-mode and multi-mode matching cannot meet the needs well in many practical application fields. The demand for set matching problems such as "a given text needs to hit multiple feature strings at the same time, and these strings need to be compounded in a specific order" is increasing. The focus of research has changed from the traditional single-mode and multi-mode The study of matching shifts to more complex matching with compound rule sets.

[0003] At present, researchers' main research methods for compound rule matching include t...

Examples

Embodiment Construction

[0054] In order to facilitate the understanding of those skilled in the art, the present invention will be further described below in conjunction with the accompanying drawings, which cannot be used to limit the protection scope of the present invention.

[0055] The invention provides a composite rule matching method in which each sub-feature string is a partial order, which is suitable for the field of feature string matching such as network information security and text retrieval. The solution of the present invention first preprocesses the compound rule set, splits the compound rule set into two rule sets, one is a feature string rule set, each character string is obtained in the process of restoring the compound rule, and each Each feature string corresponds to a unique ID. The other is a set of regular expressions, each of which is formed by concatenating IDs corresponding to several feature strings with ".*". During the matching process, we use a two-round matching met...

Images