Network Security Pattern Matching Card and Analyzing Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network security devices face a high erroneous detection rate due to simple pattern matching methods when dealing with complex signature patterns, which hampers their ability to effectively detect and block malicious traffic.
Innovation Solution
A pattern matching system and method that integrates hardware (pattern matching card) and software (analyzing engine) to enhance signature pattern detection, allowing for complex pattern analysis through a protocol analyzing engine, rule analyzing engine, and detecting/blocking engine, which enables single-packet and multi-packet based analysis to accurately identify and block malicious traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If simple pattern matching is used in conventional network security devices, then the device complexity is reduced, but the detection precision of complex signature patterns deteriorates and erroneous detection rate increases
Solution Approach 1:
The system divides the pattern matching task into two segments: the pattern matching card handles rapid pattern matching using stored signature patterns, while the analyzing engine performs complex rule analysis and packet analysis. This segmentation allows each component to specialize, improving both detection precision for complex patterns and managing device complexity through functional division.
Solution Approach 2:
The analyzing engine acts as an intermediary between the pattern matching card and the detection system. It receives pattern matching results from the card, performs additional rule-based analysis, and makes final detection decisions. This intermediary layer enables complex signature pattern detection without requiring the entire system to be overly complex.
2Speed
If hardware pattern matching card is used, then the pattern matching speed is improved, but the ability to handle complex signature patterns deteriorates
Solution Approach 1:
The system merges the strengths of hardware (pattern matching card for rapid matching) and software (analyzing engine for complex rule analysis) into a unified detection system. The pattern matching card provides speed through hardware acceleration, while the analyzing engine provides adaptability for complex patterns through flexible rule processing, achieving both speed and versatility simultaneously.
Solution Approach 2:
The analyzing engine serves multiple functions: it analyzes packets, processes pattern matching results from the card, applies complex rules, and makes detection decisions. This multi-functional component enables the system to handle various types of signature patterns (both simple and complex) through a single versatile engine, improving adaptability while maintaining the speed benefits of the hardware card.
3Loss of time
If single-packet-based analysis is used, then the processing time is reduced, but the detection accuracy for multi-packet attacks deteriorates
Solution Approach 1:
The system dynamically adjusts its analysis approach based on the detection needs. The analyzing engine can process packets individually when speed is critical, or aggregate multiple packets when detecting complex multi-packet attacks. This dynamic flexibility allows the system to optimize between processing time and detection reliability depending on the specific threat scenario.
Solution Approach 2:
The pattern matching card performs preliminary pattern matching on each packet as it arrives, providing immediate results for single-packet detection. The analyzing engine then uses these preliminary results to determine whether further multi-packet analysis is needed, enabling rapid initial processing while maintaining the capability for more thorough analysis when required.
Data Source
AI summary
A pattern matching system for a network security device includes a pattern matching card configured to generate a pattern matching result by matching data of a received packet with a pre-stored pattern of a signature pattern table, and an analyzing engine configured to copy the packet and transfer the copied packet to the pattern matching card and configured to detect a bad traffic based on packet analysis information of the packet and the pattern matching result received from the pattern matching card. The analyzing engine is configured to detect a bad traffic based on a pattern matching result for a single packet and packet analysis information during a single-packet-based analysis and is configured to detect a bad traffic based on a pattern matching result for successive packets and packet analysis information during a multi-packet-based analysis.