Network Device Signature Pattern Detection Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing pattern matching technologies face challenges in achieving fast processing speeds while maintaining flexibility and reconfigurability, with hardware-based methods being rigid and slow to adapt, and software-based methods being slower but more adaptable.
Innovation Solution
A hardware-based signature detection engine that decomposes arbitrary length signature patterns into smaller substrings and uses logic circuits to search for these substrings in network traffic, generating substring indicators to quickly identify pattern matches within network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If hardware-based pattern matching is used, then processing speed is improved, but adaptability and reconfigurability deteriorate
Solution Approach 1:
The patent segments signature patterns into multiple substrings and uses separate hardware search modules for each substring. This allows the system to maintain hardware-level processing speed while enabling flexible configuration of different substring combinations to match various signature patterns, thus resolving the contradiction between speed and adaptability.
Solution Approach 2:
The patent implements dynamic reconfiguration capabilities where the hardware search system can be reprogrammed with different signature patterns and substring configurations. This dynamic nature allows the hardware system to adapt to changing security threats while maintaining fast processing speeds, overcoming the rigidity limitation of traditional hardware implementations.
2Adaptability or versatility
If software-based pattern matching is used, then adaptability is improved, but processing speed deteriorates
Solution Approach 1:
The patent replaces software-based pattern matching with a hardware-based implementation that uses logic circuits and dedicated search modules. This substitution eliminates the overhead of instruction cycles and operating system interference, achieving hardware-level processing speeds while maintaining the flexibility to update signature patterns through reconfiguration.
Solution Approach 2:
The patent creates a universal hardware search engine that can match multiple different signature patterns simultaneously by using configurable search modules. This multi-functional capability allows a single hardware system to perform various pattern matching tasks at high speed, eliminating the need for separate software implementations for each signature type.
3Ease of manufacture
If traditional pattern matching methods are used, then implementation simplicity is improved, but detection precision for complex patterns deteriorates
Solution Approach 1:
The patent divides complex signature patterns into smaller substring components that can be independently searched by dedicated hardware modules. This segmentation enables precise matching of complex patterns while keeping the implementation straightforward, as each module handles a specific substring and the results are combined to determine overall pattern matches.
Data Source
AI summary
A network device includes a substring indicator memory and a signature search module for detecting a signature pattern within a stream of network traffic. The signature search module is configured to receive the stream of network traffic, identify a first subject substring from the stream of network traffic, generate a first substring indicator for the first subject substring using a first bitmask on the first subject substring, the first bitmask identifying a plurality of masked bits of the first subject substring, identify a first counter using the first substring indicator as an address into the substring indicator memory, and generate an indication that the signature pattern may be present in the stream of network traffic based on a value of the first counter.