Intrusion protection system (ips) for hash-based string detection without memory lookup table

A non-transitory computer-readable media storing source code in an intrusion protection system (IPS) device on a data communication network that, when executed by a processor, performs a method for hash-based string detection of variable length signatures from data packets using fixed logic memory and without using a memory lookup table for stored signatures, the method comprising the steps of:

• receiving, prior to deployment to real-time network traffic, a group of rule-based signatures as configuration input, each signature comprising a string identifier, a string length, and a character string;
• generating a cyclic redundancy check (CRC) rule for each CRC parity check circuit from a bank of CRC parity check circuits for mapping a fixed-length CRC output to a signature, each of the CRC parity check circuits servicing a specific string length;
• receiving, in real-time network traffic, a specific data packet from a session of data packets on the data communication network;
• analyzing the specific data packet to determine whether a character string of the specific data packet matches fixed-length CRC output for at least one of the stored signatures,
• wherein the character string of the specific data packet is hashed using a CRC parity check circuit corresponding to a length of the character string and a string mapper circuit, wherein the CRC parity circuit outputs a fixed-length parity-check data for the specific data packet, and the string mapper maps the fixed-length parity-check data for the specific data packet to one of the string identifiers associated with the group of signatures;
• and
• if a fixed-length parity-check match is found, outputting a string identifier of the match for a security action.

An intrusion protection system (IPS) device on a data communication network for hash-based string detection of variable length signatures from data packets using fixed logic memory and without using a memory lookup table for stored signatures, comprising:

• a signature database to receive, prior to deployment to real-time network traffic, a group of rule-based signatures as configuration input, each signature comprising a string identifier, a string length, and a character string;
• a cyclic redundancy check (CRC) rule generator to generate a CRC rule for each CRC parity check circuit from a bank of CRC parity check circuits for mapping a fixed-length CRC output to a signature, each of the CRC parity check circuits servicing a specific string length;
• a packet queue to receive, in real-time network traffic, a specific data packet from a session of data packets on the data communication network;
• a string ID mapper to analyze the specific data packet to determine whether a character string of the specific data packet matches fixed-length CRC output for at least one of the stored signatures,
• wherein the character string of the specific data packet is hashed using a CRC parity check circuit corresponding to a length of the character string and a string mapper circuit, wherein the CRC parity circuit outputs a fixed-length parity-check data for the specific data packet, and the string mapper maps the fixed-length parity-check data for the specific data packet to one of the string identifiers associated with the group of signatures, and
• wherein if a fixed-length parity-check match is found, outputting a string identifier of the match for a security action.