High-speed packet search method and apparatus

Abstract

A high-speed packet search method according to one embodiment of the present disclosure is a method for quickly searching for packets that match search criteria from among packets collected on a network, the method including: generating data specialized for the search criteria and storing the data in a database; and, when the search criteria are input, searching for packets that match the input search criteria based on the stored data.

Description

Technical Field

[0001] The present disclosure relates to a high-speed packet search method and apparatus. More specifically, it relates to a method and apparatus capable of quickly searching for packets corresponding to search conditions in an environment where network detection and response technology based on full packet analysis is applied.

Background Art

[0002] Network detection and response technology based on full packet collection and analysis is a technology that can quickly collect and analyze all packets entering and leaving through a company's network to discover and respond to threats.

[0003] According to the network detection and response technology based on full packet collection and analysis, it is possible to analyze not only abnormal behaviors by company insiders but also security threats that may occur in the services operated by the company.

[0004] Despite such advantages, the fact is that it still takes a considerable amount of time to search for desired packets from a large amount of data in the form of full packets.

Summary of the Invention

Problems to be Solved by the Invention

[0005] The problem to be solved by the present disclosure is to provide a packet high-speed search method and apparatus capable of quickly searching for packets corresponding to search conditions from a large amount of data in the form of full packets.

[0006] The problem to be solved by the present disclosure is not limited to the problems mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the following description.

Means for Solving the Problems

[0007] To solve the aforementioned problems, a high-speed packet search method according to one embodiment of the present disclosure is a method for quickly searching for packets that match search conditions from packets collected on a network, and includes the steps of: generating data specific to the search conditions and storing it in a database; and searching for packets that match the input search conditions based on the stored data.

[0008] To solve the aforementioned problems, a high-speed packet device according to one embodiment of the present disclosure includes one or more processors; and one or more memories configured to store instructions for the one or more processors to perform an operation, the operation including generating and storing data specific to the search criteria in a database in order to quickly search for packets that match the search criteria from packets collected on the network; and searching for packets that match the input search criteria based on the stored data.

[0009] Specific details of other embodiments are included in the detailed description and drawings. [Effects of the Invention]

[0010] According to the embodiments of this disclosure, packets matching the search criteria can be searched at high speed from a large amount of data, such as full packets, thereby reducing the time required for corporate security administrators to recognize and respond to cyberattacks.

[0011] The effects of this disclosure are not limited to those mentioned above, and any other effects not mentioned can be clearly understood by an ordinary person from the following description. [Brief explanation of the drawing]

[0012] [Figure 1] This is a diagram illustrating the configuration of a high-speed packet search device according to an embodiment of the present disclosure. [Figure 2]This drawing illustrates a metatable relating to an embodiment of the present disclosure. [Figure 3] This drawing illustrates a meta description table relating to an embodiment of the present disclosure. [Figure 4] This is a diagram illustrating an IP index table according to an embodiment of the present disclosure. [Figure 5] This diagram illustrates the search process using the IP index table shown in Figure 4. [Figure 6] This is a diagram illustrating an LPM table according to an embodiment of the present disclosure. [Figure 7] This figure illustrates a conversion table containing URLs and constant values ​​for URLs according to an embodiment of the present disclosure. [Figure 8] This drawing illustrates a hash table according to an embodiment of the present disclosure. [Figure 9] This is a flowchart illustrating a high-speed packet search method according to an embodiment of the present disclosure. [Modes for carrying out the invention]

[0013] The advantages and features of this disclosure, and how they are achieved, will become clearer with reference to the examples described below in detail with the accompanying drawings. However, this disclosure is not limited to the examples presented below and can be embodied in a variety of different forms. These examples are provided to complete the disclosure and to fully inform those who are ordinary skill in the art to which this disclosure pertains, and this disclosure is defined only by the scope of the claims.

[0014] Unless otherwise defined, all terms used herein (including technical and scientific terms) should be used in a way that is commonly understood by a person of ordinary skill in the art to which this disclosure pertains. Furthermore, terms defined in commonly used dictionaries should not be interpreted ideally or excessively unless explicitly defined otherwise.

[0015] The terms used in this specification are for the purpose of describing embodiments and are not intended to limit the present disclosure. In this specification, the singular form also includes the plural form unless specifically stated otherwise in the context. The terms "comprises" and / or "comprising" used in the specification do not exclude the presence or addition of one or more other components in addition to the recited components.

[0016] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. The same reference numerals in the drawings denote the same components.

[0017] FIG. 1 is a diagram illustrating the configuration of a high-speed packet search device 100 according to an embodiment of the present disclosure.

[0018] The high-speed packet search device 100 according to an embodiment of the present disclosure uses a database specialized for packet search functions instead of a relational database management system (RDBMS) having various functions. In particular, among various search conditions such as IP (Internet Protocol), port, URL (Uniform Resource Locator), application, and file, a database specialized for search conditions of IP and URL is used.

[0019] Referring to FIG. 1, the high-speed packet search device 100 includes a meta-table generation unit 110, a meta-description table generation unit 120, an IP index table generation unit 130, an LPM table generation unit 140, a conversion table generation unit 150, a hash table generation unit 160, a database 170, and a control unit 180.

[0020] Among the components illustrated in FIG. 1, the meta-table generation unit 110, the meta-description table generation unit 120, and the IP index table generation unit 130 can operate as the first search engine. When an IP less than the reference number is input as a search condition, the first search engine generates data necessary for quickly searching for packets corresponding to the input IP and stores the data in the database 170.

[0021] Among the components illustrated in FIG. 1, the meta-table generation unit 110 and the LPM table generation unit 140 can operate as the second search engine. When a large number of IP lists equal to or more than the reference number are input as a search condition, the second search engine generates data necessary for quickly determining whether the IP of the packets collected in the network is included in the input IP list and stores the data in the database 170.

[0022] Among the components illustrated in FIG. 1, the conversion table generation unit 150 and the hash table generation unit 160 can operate as the third search engine. When a URL is input as a search condition, the third search engine generates data necessary for quickly searching for packets corresponding to the input URL and stores the data in the database.

[0023] The control unit 180 determines the type and / or number of the input search conditions. For example, it determines whether the input search condition is an IP or a URL. If the input search condition is an IP, it determines whether an IP less than the reference number is input or a large number of IP lists are input. Based on such a determination result, the control unit 180 can select data to be utilized for the search from the data stored in the database 170.

[0024] Hereinafter, the components illustrated in FIG. 1 will be described more specifically.

[0025] The metatable generation unit 110 sorts the collected packets based on their IP addresses and generates a metatable as illustrated in Figure 2. Referring to Figure 2, it can be seen that the IP addresses are sorted in ascending order, and that each sorted IP address is assigned a primary index, which is a number indicating its position within the metatable. Furthermore, since the metatable sorts all collected packets based on their IP addresses, it can be seen that the same IP address appears multiple times. For the sake of explanation, a group consisting of the same IP address will be referred to as an "identical IP interval" below.

[0026] The meta description table generation unit 120 extracts the first IP located in each identical IP interval of the meta table and its primary index, and generates a meta description table as illustrated in Figure 3. Referring to Figure 3, it can be seen that the first IP extracted in each identical IP interval is sorted based on the primary index. It can also be seen that the sorted IPs are assigned a secondary index, which is a number indicating their position within the meta description table.

[0027] The IP index table generation unit 130 generates an IP index table as illustrated in Figure 4 based on the meta description table. The IP index table is used to quickly retrieve secondary indexes within the meta description table in relation to the IP being searched.

[0028] Before specifically explaining the IP index table with reference to Figure 4, let's briefly explain IP. IP is divided into the IPv4 and IPv6 systems. In the IPv4 system, one IP address is represented by four sets of three-digit numbers. Each set is called an octet and is processed internally with 32 bits (8 bits per set). For example, 192.168.123.123 is represented as 11000000.10101000.1111011.1111011.

[0029] IP is divided into A, B, C, D, and E classes based on bandwidth. Class A is used for large-scale network environments, where the first 8 bits represent the network ID and the second to fourth 24 bits represent the host ID. Class B is used for medium-scale network environments, where the first and second 16 bits represent the network ID and the third and second 16 bits represent the host ID. Class C is used for small-scale network environments, where the first to third 24 bits represent the network ID and the fourth 8 bits represent the host ID. Class D is used for multicasting. Class E is reserved for research / development or future use and is not used for general purposes. The IPv4 class classification described above is shown in Table 1.

[0030] [Table 1]

[0031] Referring to Figure 4, the basic unit of an IP index table consists of four fields. Specifically, the basic unit is configured to include a class field, a value field, an index field, and a jump field, and these basic units come together to form an IP index table. Each basic unit may be assigned a tertiary index, which is a number indicating its position within the IP index table.

[0032] The class field records an index indicating the position of each octet in the IP address. That is, an index indicating the position of each delimiter is recorded. For example, in the case of class C, the first to third of the four delimiters represent the network ID. Therefore, an index is needed to distinguish between the first to third delimiters. According to the example, the index for the first delimiter may be set to "0", the index for the second delimiter to "1", and the index for the third delimiter to "2". In other words, Octet 1=0, Octet 2=1, Octet 3=2.

[0033] The value field stores the delimiter value corresponding to the index in the class field. For example, if the class field contains 0, the value field will store the first delimiter value of the IP. If the class field contains 1, the value field will store the second delimiter value of the IP.

[0034] The index field records the secondary index in the meta description table that relates to the value recorded in the value field. If there is no related secondary index, the index field may record "0".

[0035] The jump field records the tertiary index of the base unit where the next value to compare is recorded if the value recorded in the value field does not match the IP value being searched.

[0036] Figure 4 illustrates the case where each basic unit is aligned vertically, but the basic units may also be aligned horizontally or in a matrix configuration. The generated IP index table can be stored in database 170.

[0037] Figure 5 is a diagram illustrating the process of searching for a specific IP address using the IP index table exemplified in Figure 4.

[0038] Referring to Figure 5, it can be seen that the basic units of the IP index table exemplified in Figure 4 are listed horizontally, and that some of the basic units are divided in a step-like manner.

[0039] Let's assume the IP address 1.2.1.1 is entered as the search condition. In this case, the base unit with a tertiary index of "0" in the IP index table is referenced first. Interpreting the values ​​recorded in the class field and value field of the corresponding base unit in the IP index table, we need to check if "the value of the first delimiter is 1". In the IP entered as the search condition, the value of the first delimiter is "1", which matches the value "1" recorded in the value field. However, we can see that "0" is recorded in the index field of the referenced base unit. This means that there is no secondary index in the meta description table. Therefore, the base unit with a tertiary index assigned in the following order is referenced. That is, the base unit with a tertiary index of "1" is referenced.

[0040] Interpreting the values ​​recorded in the class and value fields of the referenced base unit, we need to check if the value of the second delimiter is 1. In the IP entered as a search condition, the value of the second delimiter is "2," which does not match the value of "1" recorded in the value field. When the values ​​do not match in this way, we check the jump field of the referenced base unit. We can see that the jump field is recorded as "4." This means that we must skip the base units with a tertiary index of "2" and "3," and jump to the base unit with a tertiary index of "4." As a result, the base unit with a tertiary index of "4" is referenced.

[0041] Interpreting the values ​​recorded in the class and value fields of the referenced base unit, the question is whether "the second delimiter value is 2". In the IP entered as a search condition, the second delimiter value is "2", which matches the value "2" recorded in the value field. However, it can be seen that "0" is recorded in the index field of the referenced base unit. This means that there is no secondary index in the meta description table. Therefore, the base unit with the following tertiary index is referenced. That is, the base unit with a tertiary index of "5" is referenced.

[0042] Interpreting the values ​​recorded in the class and value fields of the referenced base unit, the question is whether "the third delimiter value is 1". In the IP entered as a search condition, the third delimiter value is "1", which matches the value "1" recorded in the value field. However, it can be seen that "30" is recorded in the index field of the referenced base unit. Thus, if there is a value recorded in the index field, that value is retrieved.

[0043] Subsequently, the system searches the meta description table for a secondary index identical to the value "30" obtained from the index field. As a result, the primary index corresponding to the secondary index is obtained. Referring to Figure 3, it can be seen that the primary index "200" corresponds to the secondary index "30". Once the primary index is obtained, the IP addresses corresponding to the obtained primary index can be searched in the pre-stored meta table.

[0044] According to the method described above, it is possible to approach the interval containing the desired data within a maximum of 765 (=255+255+255) iterations. Specifically, it is possible to approach the interval containing the desired data within 4 to 765 iterations.

[0045] Referring again to Figure 1, the LPM table generation unit 140 converts an IP list with a minimum number of entries into an LPM (Longest Prefix Matching) table. The LPM table has 256 cells arranged horizontally. Hereafter, these 256 cells arranged horizontally will be referred to as the "base row". The 256 cells included in the base row are assigned an index from 0 to 255 (hereinafter referred to as the "horizontal index"). Each cell can have one value, either 0 or 1. Specifically, cells in the base row that have the same horizontal index as the first separator value of the IPs included in the IP list are set to a value of "1". For example, suppose the IP list includes the following IPs.

[0046] 192.168.10.232

[0047] 193.168.10.232

[0048] In this case, the values ​​of the first delimiter are 192 and 193. Therefore, the values ​​of the cells in the reference row with horizontal index "192" and the cells with horizontal index "193" can each be set to 1. The values ​​of all remaining cells can all be set to 0.

[0049] At the bottom of the reference row, rows containing the same number of cells as the reference row are successively arranged. Cells arranged vertically are assigned indices corresponding to the range of values ​​for the first delimiter, the second delimiter, and the third delimiter, in that order (hereinafter referred to as "vertical indices"). If an IP included in the IP list is of class C, the range of values ​​for the first delimiter is 192 to 223. The ranges of values ​​for the second and third delimiters are 0 to 255, respectively. Therefore, cells arranged vertically are assigned vertical indices corresponding to the range of values ​​for the first delimiter (192 to 223), the second delimiter (0 to 255), and the third delimiter (0 to 255), in that order.

[0050] For example, if the IP list contains only the IP "192.168.10.232", an LPM table like the one shown in Figure 6 will be generated. Since the first delimiter value of the IP is 192, the value of the cell with a horizontal index of 192 in the reference row is set to 1 (cells with a value of 1 are displayed in a different hue than cells with a value of 0). When the first delimiter value is 192, the second delimiter value is 168, so the row with a vertical index of 192 in the vertical index corresponding to the range of the first delimiter value is selected, and the value of the cell with a horizontal index of 168 in the cell belonging to the selected row is set to 1. Also, when the second delimiter value is 168, the third delimiter value is 10, so the row with a vertical index of 168 in the vertical index corresponding to the range of the second delimiter value is selected, and the value of the cell with a horizontal index of 10 in the cell belonging to the selected row is set to 1. Furthermore, when the value of the third separator is 10, the value of the fourth separator is 232. Therefore, among the vertical indices corresponding to the range of the third separator's value, the row with a vertical index of 10 is selected, and the value of the cell with a horizontal index of 232 within the selected row is set to 1.

[0051] After the LPM table is generated in this manner, if the IP address of the actually collected packet is "192.168.10.232", the process of querying the IP address of the collected packet in the IP list is as follows:

[0052] First, a query is made for the first delimiter value of IP. In the reference row of the LPM table, the value of the cell with a horizontal index of 192 is 1, so it is determined that the first delimiter value exists in the LPM table. Therefore, a query is made for the second delimiter value. In the LPM table, among the vertical indexes corresponding to the range of the first delimiter value, the value of the cell with a vertical index of 192 and a horizontal index of 168 is 1, so it is determined that the second delimiter value exists in the LPM table. Therefore, a query is made for the third delimiter value. In the LPM table, among the vertical indexes corresponding to the range of the second delimiter value, the value of the cell with a vertical index of 168 and a horizontal index of 10 is 1, so it is determined that the third delimiter value exists in the LPM table. Therefore, a query is made for the fourth delimiter value. In the LPM table, among the vertical indexes corresponding to the range of the third delimiter value, the value of the cell with a vertical index of 10 and a horizontal index of 232 is 1, so it is determined that the fourth delimiter value exists in the LPM table. In this way, it is possible to determine whether the relevant IP is included in the IP list through a total of four comparison processes, which significantly reduces the number of comparisons compared to conventional methods. Specifically, if n IPs are acquired in the collected packets and the company has a pre-existing blacklist of m IPs, conventionally, n × m comparisons would have to be performed. However, by using the LPM table according to the embodiment of this disclosure, only a minimum of n × 1 to a maximum of n × 4 comparisons need to be performed, so the number of comparisons is greatly reduced. And the search speed is improved by the amount by which the number of comparisons is reduced.

[0053] Referring again to Figure 1, the conversion table generation unit 150 converts the URLs of the collected packets into constant values. Although URLs are in text format with no specified length, converting such URLs into constant values ​​means assigning an ID to the URL. Here, the ID may mean a Primary Key (PK). An example of a conversion table containing URLs and their constant values ​​is shown in Figure 7.

[0054] The hash table generation unit 160 generates a hash table of a standard size based on a constant value. The standard size may be, for example, 65536. However, the standard size is not limited to the example given, and may be smaller or larger than the example given. For the sake of explanation, the case where the standard size is 65536 will be used as an example below.

[0055] Figure 8 is a diagram illustrating an example of a hash table according to an embodiment of the present disclosure.

[0056] Referring to Figure 8, the hash table includes a hash index and a cumulative value. The hash index is determined by the remainder when the URL ID is divided by 65536. Therefore, the hash index ranges from 0 to 65535. IDs with the same hash index are recorded sequentially under their respective hash indexes.

[0057] The cumulative value is calculated by sequentially adding up the number of IDs recorded in each hash index. For example, we can see that a total of 3 IDs are recorded in hash index 0, a total of 4 IDs are recorded in hash index 1, and a total of 2 IDs are recorded in hash index 2. In this case, the cumulative value for hash index 1 is 3 + 4 = 7, and the cumulative value for hash index 2 is 7 + 2 = 9.

[0058] Such cumulative values ​​can be used to narrow the search scope. For example, suppose the URL "naver.com" is entered as the search condition. Referring to Figure 7, the ID for the URL "naver.com" is 2, so the hash index is also "2". In Figure 8, we can see that the cumulative value for hash index 2 is 9, and the previous cumulative value was 7. This means that the search result can be obtained with just two accesses from the previous cumulative value (7) to the current cumulative value (9), meaning that the result can be obtained by searching only 7 to 9 metadata entries.

[0059] Figure 9 is a flowchart illustrating a high-speed packet search method according to an embodiment of the present disclosure.

[0060] First, data specific to the search criteria is generated and stored in database 170 (S910). Here, IP and URL can be used as examples of search criteria. In the case of IP, IPs less than a certain number may be used as search criteria, or a list of IPs greater than or equal to the certain number may be used as search criteria. For example, a black IP list containing more than one million IP addresses that a company has reserved in advance may be used as search criteria. Examples of data specific to searching for IPs less than a certain number include a meta table, a meta description table, and an IP index table. An example of data specific to searching for IP lists is an LPM table. Examples of data specific to searching for URLs include a conversion table containing URLs and constant values ​​of URLs, and a hash table.

[0061] Subsequently, the system searches for packets that match the entered search criteria based on the data stored in the database (S920).

[0062] At step S920, if the entered search criteria contain fewer IPs than the specified number, the IP index table, meta description table, and meta table may be selected from the data stored in database 170. The value of each IP delimiter entered as a search criterion is compared with the value determined by the class field and value field of the base unit in the IP index table. If the two values ​​match, the value of the index field of the base unit is used to search for the secondary and primary indexes in the meta description table. If the two values ​​do not match, the system jumps to the base unit indicated by the value of the jump field of the base unit. By using the value of the jump field in this way, the number of comparisons is reduced, and the search speed is improved by the amount by which the number of comparisons is reduced.

[0063] At step S920, if the entered search condition is a large IP list, the LPM table may be selected from the data stored in the database. Then, the values ​​of each delimiter in the large IP list are compared with the values ​​of each cell in the LPM table. If, during the comparison process, it is determined that the values ​​of each delimiter in the IP list are not recorded in the LPM table, the comparison process is immediately interrupted.

[0064] In step S920, if the entered search condition is a URL, a conversion table and hash table stored in the database may be selected. By referring to the conversion table, an ID corresponding to the URL entered as the search condition is retrieved. Subsequently, when the retrieved ID is divided by 65536, the remainder is calculated, and a hash index with the same value as the calculated value and its corresponding cumulative value can be obtained from the hash table.

[0065] Embodiments of the present disclosure have been described above. The components constituting the high-speed packet lookup device illustrated in Figure 1 in the above description can be embodied in modules. A module means software or hardware components such as a Field Programmable Gate Array (FPGA) or Application Specific Integrated Circuit (ASIC), and the module performs some role. However, the meaning of a module is not limited to software or hardware. A module may be configured to reside on an addressable storage medium and may be configured to run one or more processors.

[0066] Therefore, as an example, a module includes components such as software components, object-oriented software components, class components, and task components, as well as processes, functions, attributes, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and variables. The functionality provided by components and modules can be further combined with even fewer components and modules, or further separated into additional components and modules.

[0067] On the other hand, the disclosed embodiments may be embodied in the form of a recording medium for storing computer-executable instruction words. The instruction words may be stored in the form of program code, which, when executed by a processor, can generate a program module to perform the operations of the disclosed embodiments. The recording medium may be a computer-readable recording medium.

[0068] Computer-readable recording media include all types of recording media that store instruction words that can be deciphered by a computer. Examples include ROM (read-only memory), RAM (random access memory), magnetic tape, magnetic disk, flash memory, and optical data storage devices.

[0069] Furthermore, computer-readable recording media may be provided in the form of non-transitory storage media. Here, "non-transitory storage media" simply means a tangible device that does not contain signals (e.g., electromagnetic waves), and this term does not distinguish between cases where data is stored semi-permanently and cases where it is stored temporarily. For example, "non-transitory storage media" may include buffers in which data is stored temporarily.

[0070] According to one embodiment, the methods relating to the various embodiments disclosed herein may be provided as part of a computer program product. The computer program product may be traded as a commodity between sellers and buyers. The computer program product may be distributed in the form of a device-readable recording medium (e.g., compact disc read-only memory (CD-ROM)), or through an application store (e.g., Play Store™), or directly between two user devices (e.g., smartphones), or online (e.g., download or upload). In the case of online distribution, at least a portion of the computer program product (e.g., a downloadable app) may be at least temporarily stored or temporarily generated on a device-readable recording medium such as the memory of a manufacturer's server, an application store server, or an intermediary server.

[0071] Embodiments relating to this disclosure have been described above with reference to the attached drawings. A person having ordinary skill in the art to which this disclosure belongs will understand that this disclosure may be implemented in other specific forms without altering the technical idea or essential features thereof. Accordingly, the embodiments described above should be understood in all respects to be illustrative and not limiting. [Industrial applicability]

[0072] The high-speed packet search methods and devices described above can be applied to network detection and response technologies for a full packet analysis infrastructure.

Claims

1. In a method for quickly searching for packets that match search criteria from packets collected on a network, The steps include: generating IP-related data as data specific to the aforementioned search criteria and storing it in a database; and, The process includes the step of searching for packets that match the entered search criteria based on the stored data, The aforementioned preservation step is, The steps include sorting the packets collected in the aforementioned network based on IP address, assigning a primary index to the sorted packets, and generating a metatable; A step of generating a meta description table by extracting the first IP located in each IP interval of the meta table and the primary index of the first IP, and assigning a secondary index to the extracted IP; and, The process includes generating an IP index table for quickly accessing a secondary index related to the IP entered as a search condition within the secondary index of the meta description table, The aforementioned IP index table includes multiple basic units, The aforementioned basic unit includes a class field, a value field, an index field, and a jump field. Multiple of the aforementioned basic units are assigned a third-level index. The class field records an index indicating the position of each delimiter in the meta description table, The value field records a delimiter value corresponding to the index of the class field. If the IP corresponding to the delimiter value corresponding to the index of the class field, recorded in the value field, exists in the meta description table, the secondary index of that IP in the meta description table is recorded in the index field. If the IP corresponding to the delimiter value corresponding to the index of the class field, recorded in the value field, does not exist in the meta description table, then "0" is recorded in the index field. The jump field records the tertiary index of the base unit where the next value to be compared is recorded if the value recorded in the value field does not match the IP value entered as the search condition. The aforementioned search step is, The step of comparing the values ​​of each IP delimiter entered as the search condition with the values ​​determined by the class field and value field of the basic unit of the IP index table; If the comparison results in both values ​​matching, the value of the index field of the base unit is referenced; if the value of the index field is not "0", a secondary index matching the value of the index field is searched in the meta description table; and if the value of the index field is "0", the base unit to which the following tertiary index in the IP index table is assigned is referenced; A high-speed packet lookup method that, if the comparison results in both values ​​not matching, includes a step of jumping to the base unit indicated by the value of the jump field of the base unit.

2. In the processor, In order to quickly search for packets that match the search criteria from among the packets collected on the network, IP-related data is generated as data specific to the said search criteria and stored in a database; and, The instruction includes a command configured to perform a search for packets that match the input search criteria based on the stored data, The aforementioned preservation is The packets collected in the aforementioned network are sorted based on IP address, and a primary index is assigned to the sorted packets to generate a metatable; Extract the first IP located within each IP interval of the meta table, and the primary index of the first IP located, and assign a secondary index to the extracted IP to generate a meta description table; and, This includes generating an IP index table for quickly accessing a secondary index related to the IP entered as a search condition within the secondary index of the meta description table, The aforementioned IP index table includes multiple basic units, The aforementioned basic unit includes a class field, a value field, an index field, and a jump field. Multiple of the aforementioned basic units are assigned a third-level index. The class field records an index indicating the position of each delimiter in the meta description table, The value field records a delimiter value corresponding to the index of the class field. If the IP corresponding to the delimiter value recorded in the value field exists in the meta description table, the index field records the secondary index of that IP in the meta description table; if the IP corresponding to the delimiter value recorded in the value field does not exist in the meta description table, the index field records "0". The jump field records the tertiary index of the base unit where the next value to be compared is recorded if the value recorded in the value field does not match the IP value entered as the search condition. The aforementioned search is, Compare the values ​​of each IP delimiter entered as the search condition with the values ​​determined by the class field and value field of the basic unit in the IP index table; If the comparison results in both values ​​matching, the value of the index field of the base unit is referenced; if the value of the index field is not "0", a secondary index matching the value of the index field is searched in the meta description table; and if the value of the index field is "0", the base unit to which the following tertiary index in the IP index table is assigned is referenced; A computer-readable recording medium that, if the comparison results in a mismatch between the two values, jumps to the base unit indicated by the value of the jump field of the base unit.

3. One or more processors; and, The system includes one or more memories configured to store instructions that cause one or more processors to perform an operation, The above work is, In order to quickly search for packets that match the search criteria from among the packets collected on the network, IP-related data is generated as data specific to the said search criteria and stored in a database; and, Includes searching for packets that match the entered search criteria based on the stored data; The aforementioned preservation is The packets collected in the aforementioned network are sorted based on IP address, and a primary index is assigned to the sorted packets to generate a metatable; Extract the first IP located within each IP interval of the meta table, and the primary index of the first IP located, and assign a secondary index to the extracted IP to generate a meta description table; and, This includes generating an IP index table for quickly accessing a secondary index related to the IP entered as a search condition within the secondary index of the meta description table, The aforementioned IP index table includes multiple basic units, The aforementioned basic unit includes a class field, a value field, an index field, and a jump field. Multiple of the aforementioned basic units are assigned a third-level index. The class field records an index indicating the position of each delimiter in the meta description table, The value field records a delimiter value corresponding to the index of the class field. If the IP corresponding to the delimiter value corresponding to the index of the class field, recorded in the value field, exists in the meta description table, the secondary index of that IP in the meta description table is recorded in the index field. If the IP corresponding to the delimiter value corresponding to the index of the class field, recorded in the value field, does not exist in the meta description table, then "0" is recorded in the index field. The jump field records the tertiary index of the base unit where the next value to be compared is recorded if the value recorded in the value field does not match the IP value entered as the search condition. The aforementioned search is, Compare the values ​​of each IP delimiter entered as the search condition with the values ​​determined by the class field and value field of the basic unit in the IP index table; If the comparison results in both values ​​matching, the value of the index field of the base unit is referenced; if the value of the index field is not "0", a secondary index matching the value of the index field is searched in the meta description table; and if the value of the index field is "0", the base unit to which the following tertiary index in the IP index table is assigned is referenced; A high-speed packet lookup device that, if the comparison results in a mismatch between the two values, includes jumping to the base unit indicated by the value of the jump field of the base unit.

Images