Back to results
US 2009/0158427 A1Published application
Signature string storage memory optimizing method, signature string pattern matching method, and signature string matching engine
AssigneeElectronics and Telecommunications Research Institute
InventorsByoung Koo Kim, Jin Tae Oh, Jong Soo Jang, Sung Won Sohn
Life of this patent
Estimating the term…
Abstract
Enclosed are a signature string storage memory optimizing method, a signature string pattern matching method, and a signature matching engine. Signature is tokenized in units of substrings and the tokenized substrings are stored in an internal memory block and an external memory block to optimize a memory storage pattern. Therefore, matching of introduction data to signature patterns is effectively performed.
Claims20
A method of optimizing a signature string storage memory, comprising:
- tokenizing signature string patterns to be used as searching patterns of a harmful packet to substrings;
- determining whether a substring to be stored in the substrings is the same as a substring of another previously stored signature string pattern to share a corresponding memory table when it is determined that the substring to be stored is the same as the substring of the other previously stored signature string pattern and to analyze whether the substring to be stored is a first substring when it is determined that the substring to be stored is not the same as the substring of the other previously stored signature string pattern;
- storing the substring in an internal memory block when it is determined that the substring to be stored is the first substring and analyzing whether a memory table in which a substring previous to the substring to be stored is stored is linked to a memory table in which another substring corresponding to a position of the substring to be stored is stored when it is determined that the substring to be stored is not the first substring;
- and
- storing the substring in an external memory block when it is determined that the memory table in which the substring previous to the substring to be stored is stored is not linked to the memory table in which another substring corresponding to the position of the substring to be stored is stored and storing the substring in the internal memory block when it is determined that the memory table in which the substring previous to the substring to be stored is stored is linked to the memory table in which another substring corresponding to the position of the substring to be stored is stored.
2 more elements
A method of matching signature string patterns, comprising:
- dividing a payload of introduction traffic to be the same as a size of a signature substring character column stored in a signature matching engine;
- calling a memory table of an internal memory block address corresponding to the hash value of the character column to be searched when a character column previous to a character column to be searched in the character columns of the divided introduction traffic was not matched to the stored signature substring;
- stopping a matching process when the signature substring stored in the called memory table is not matched to the character column to be searched and analyzing whether the matched signature substring is the last substring in the signature substrings when the signature substring stored in the called memory table is matched to the character column to be searched;
- and
- analyzing whether the character column to be searched is matched to the substring stored in the called external memory block address when an external memory block address is called from the called memory table when the matched signature substring is not the last substring and generating an alarm when the matched signature substring is the last substring.
2 more elements
A signature matching engine stored in units of substrings to which signature strings for distinguishing harmful packets included in introduction traffic are tokenized, comprising:
- an internal memory block in which a memory table including the substring to be stored is included is provided when the memory table including the first substring that constitutes the signature in the substrings is linked to the memory table in which another substring corresponding to the substring to be stored in the memory table in which the previous substring is stored;
- and
- an external memory block in which a memory table including the substring to be stored is provided when the memory table in which the previous substring is stored is linked to the memory table in which the other substring corresponding to the substring to be stored is stored.
Dependencies are inferred from the claim text.