Multi-pattern Policy Detection via Stage Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional multi-pattern matching methods in network security systems suffer from repetitive comparison operations and suboptimal search performance due to inefficient signature fragment processing, leading to increased computational costs and potential over-detection in the front stage, which degrades network traffic processing performance.
Innovation Solution
A multi-pattern policy detection system and method that optimizes search performance by dividing signature fragments into a front stage and rear stage, where the front stage optimizer registers signature fragments based on length and uniqueness, and the rear stage optimizer registers fragments with low detection frequency and load influence, enabling depth search and reducing redundant comparisons.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional multi-pattern matching methods are used to detect network attacks, then signature detection can be performed, but repetitive comparison operations increase computational costs and degrade search performance
Solution Approach 1:
The patent divides the signature matching process into two distinct stages: front stage optimization that filters out obviously non-matching signatures using simple criteria, and rear stage optimization that performs detailed matching only on remaining candidates. This segmentation eliminates repetitive full-comparison operations across all signatures, reducing computational cost while maintaining detection accuracy.
Solution Approach 2:
The front stage optimization performs preliminary filtering by evaluating simple criteria (such as packet length ranges, protocol types, or obvious pattern mismatches) before the rear stage detailed matching. This preliminary action eliminates many non-matching signatures early in the process, preventing wasteful computational expenditure on signatures that would not match anyway.
2Reliability
If the front stage performs comprehensive signature matching, then detection accuracy is improved, but over-detection occurs and network traffic processing performance degrades
Solution Approach 1:
The patent applies different matching strategies to different stages: the front stage uses simple, fast filtering criteria appropriate for initial screening, while the rear stage applies more comprehensive and accurate matching only where needed. This local differentiation of quality ensures high detection accuracy for potential threats while maintaining high throughput for normal traffic that is filtered early.
Solution Approach 2:
The front stage performs a partial matching action using simplified criteria that covers the majority of non-matching cases without requiring full signature comparison. This partial action is sufficient for filtering purposes and prevents over-detection, while the rear stage completes the matching for a smaller subset of candidates that require thorough analysis.
3Measurement precision
If all signature fragments are processed in the rear stage, then comprehensive matching is achieved, but the number of matching attempts increases and search performance decreases
Solution Approach 1:
The patent segments the signature fragment processing into front stage filtering (using length, uniqueness, and simple pattern criteria) and rear stage detailed matching. This segmentation reduces the number of signature fragments that reach the time-consuming rear stage, thereby reducing the total number of matching attempts while maintaining comprehensive matching precision for the candidates that are processed.
Data Source
AI summary
Provided are a multi-pattern policy detection system and method, wherein, in an environment that operates a plurality of policies for determining matching or non-matching by a string or a normalized format, the plurality of policies are expressed by a data structure that is searchable at a time, and are optimized to improve search performance. The multi-pattern policy detection system includes: a search front stage optimizer configured to register a string of a signature fragment received from a signature fragment list as a registration pattern of a front stage of a signature by taking into account length and uniqueness of the string; a search rear stage optimizer configured to receive the signature fragment from the signature fragment list, and register the signature fragment as a registration pattern of a rear stage when there is no registration signature fragment of the rear stage; and a detection engine configured to perform attack detection by using the front stage of the search front stage optimizer and the rear stage of the search rear stage optimizer.