A message detection system, method and device

Abstract

This specification discloses a message detection system, method and device. For the received message to be detected, the system can split the message to be detected into several sub-messages according to the detection string length corresponding to the detection rule, so that The tri-state content addressable memory can match the detection rules for each sub-message and its own stored detection rules, quickly obtain the matching result, and finally determine the detection result according to the matching result and the message to be detected. Utilizing the characteristics of fast addressing of the three-state content addressable memory, the length of the detection string corresponding to the detection rule is used as the address length, and the message to be detected is split into several sub-messages of the address length, so that the content of the three-state The addressable memory can quickly perform matching, and then determine the detection result according to the matching result. It avoids frequent invocation of detection rules, reduces the pressure of data transmission, and at the same time ensures the speed of detection and improves the efficiency of packet detection.

Description

technical field [0001] The present application relates to the field of information technology, and in particular to a message detection system, method and device. Background technique [0002] A message is a data unit exchanged and transmitted during data transmission in the network. After a device receives a packet, it usually needs to detect the packet to ensure network security or system security. When sensitive content or virus features are detected in the message, the message can be deleted or discarded. [0003] At present, with the development of technology, the network environment with high transmission speed puts forward higher requirements for packet detection, and the pressure of packet detection is increasing. In the prior art, among several commonly used message detection schemes, message detection is performed through an application-specific integrated circuit. Since the detection rules are fixed in the circuit, the detection rules cannot be changed flexibly,...

AI Technical Summary

Problems solved by technology

In the prior art, among several commonly used message detection schemes, message detection is performed through an application-specific integrated circuit. Since the detection rules are fixed in the circuit, the detection rules cannot be changed flexibly, and it is difficult to adapt to the current rapidly changing network information. In the scheme of message detection using Field-Programmable Gate Array (FPGA) chips, if internal resources of FPGA are used to store detection rules, the usage cost will increase due to the large number of detection rules. Storage detection rules, such as using hard disk, double data rate synchronous dynamic random access memory (Double Data Rate SDRAM, DDR) storage detection rules, the interface between FPGA and storage device will limit the performance

Images