KR101079815B1 - Signature clustering method based grouping attack signature by the hashing - Google Patents

Abstract

The present invention relates to a signature clustering method based on attack signature classification using a bit-vector of hashing results. Since the data is automatically classified and performed, similarity or inclusion through hashing, content management, and clustering By generating the signature and analyzing the incoming packet through the generated signature, the time required to perform the task is greatly reduced and it is easy to implement in hardware. Therefore, fast pattern matching is possible. Real time processing is possible.

Hashing, Hashing, Bit vector, Signature, Signature, Signature, Clustering, Clustering

Description

Signature clustering method based grouping attack signature by the hashing}

The present invention relates to a signature clustering method based on attack signature classification using a bit-vector of a hashing result. In particular, the security system periodically classifies and performs a task for generating a signature, and according to network security. The present invention relates to a signature clustering method based on attack signature classification using a bit-vector of a hashing result value that automatically generates a signature.

The present invention is derived from the research conducted as part of the IT growth engine technology development of the Ministry of Knowledge Economy and the Ministry of Information and Communication Research and Development. [Task management number: 2006-S-042-03, Task name: Countering Zero-Day Attack of Network Threats] Development of real-time attack signature generation and management technology for

The security device and technology for service protection may be characterized as a technology for detecting an abnormal user by extracting application characteristics from a server to be protected and applying the same to a user accessing the server.

For the security of the network, it is necessary to first understand the characteristics of attack packets. The signature of the attack packet is registered as a signature, and when a signature registered in the received packet is detected, the corresponding security policy is applied to protect the target network from malicious users or programs.

The conventional automatic signature generation technique is applied by a technique of hierarchical clustering of signatures with respect to clustering of signatures. In this technique, after the contents of the signature to be generated are tokenized, each rule corresponding to the subsequence and the convention between each token is used.

The conventional intrusion pattern generation system applies distance clustering techniques such as k-means for data of normal traffic and abnormal traffic, and applies them to signatures for outliers.

If there is a certain number of flows, the technique used in the conventional Polygraph constitutes the above number of clusters, and each cluster includes one flow. However, because the technology is operated off-line, it cannot process new signatures on-line in real time.

Thereafter, clusters are repeatedly merged using Hierarchical Clustering. The clustering method used at this time is a gradient clustering method.

In the previous research, a large amount of memory and a large number of operations were required to perform a multi-pattern matching on an object with respect to several rules. In addition, there was no algorithm to determine if the current object is a subset of the existing pattern.

Accordingly, it is necessary to develop a system that can automatically generate and manage signatures through similarity or inclusion judgment and perform fast work processing.

A representative signature candidate is generated by using a bit-vector value having a result of hashing to manage and cluster a large number of signature candidate groups for repeated contents generated from 5-tuples selected as suspicious traffic to generate such a signature. As a result, a technique for real-time processing of similarity-based clustering on-line every time is required.

In addition, even if a large amount of traffic flows through prior confirmation whether one signature is included in another signature, it helps in data management. In addition, a technology capable of transmitting 5-tuple information at the same time as the signature information at the time of the traffic flow is needed to capture the traffic data including the content of the signature.

An object of the present invention is to hash the input data, manage it according to the content of the content repeatedly generated, cluster at intervals of a predetermined time, generate a signature for the clustered signature candidate group according to similarity, and use the generated signature. The present invention provides a signature clustering method based on attack signature classification using a bit-vector of hashing result values for analyzing incoming packets.

The signature clustering method according to the present invention for solving the above problems comprises the steps of: extracting a strong message as a signature candidate from the incoming packet, the security system; If the message is a first message, overlapping and hashing the message, and updating the bit vector table using the hash value to register the message; If the force message is not the first message, consequently hashing the force message and retrieving the hash value from the bit vector table; And performing the registration step if the hash value does not exist in the search result, the bit vector table, and outputting a processing result if the hash value exists.
Recording a generation time in which the signature content flows, and resetting the inflowed data by the security system when the elapsed time is greater than or equal to a preset reference time based on the generation time; Generating a signature candidate for the signature content based on a frequency of occurrence and a similarity when the elapsed time is greater than a preset clustering time; And registering the signature candidate in the signature pool SP as a new signature through an analysis of the similarity between the signature candidate and a previously registered signature.

In addition, when the data is reset, when the elapsed time is greater than a reference time for at least one of a signature pool reset time, a signature candidate node reset time, and a maximum number of signature nodes, resetting the signature pool or the signature candidate node is performed. It features.

delete

In addition, when generating the candidate, in the signature content, a node having a frequency count Hit_count for the list of the signature group SG is greater than a frequency limit Hitcount_th is formed to form a separate list, and exists in the list. When the number of nodes is greater than or equal to a predetermined number, a similarity table is formed between each node, and in the similarity table, one linked list type group is formed for nodes whose similarity value is greater than the similarity limit value (resemble_th). It is characterized by. For the group, LCSeq (Longest Common Subsequence) for extracting the same string between two nodes for a node belonging to one group is performed to generate a set of strings based on a commonly occurring sequence and to generate one in one grouping. Generates the signature candidate of.

In order to register the signature candidate in the signature pool SP for signature management, if there is a similarity with the signature in the existing signature pool SP, and if there is an existing signature having a similarity with a greater similarity than the signature candidate In this case, LCSeq (Longest Common Subsequence) of the existing signature and the current signature is performed, and the result is registered in the signature pool (SP) in which the existing signature is located, and if the similarity is not large, generated by the current grouping. The signature is registered in the signature pool SP.

When the signature pool SP is not empty, 3-gram congestive 3-gram hashing is performed on the current signature content, and signature and pattern matching are performed using the hash value. It is characterized by checking whether the signature content exists in the existing signature pool SP.

If there is at least one entry in the overall result table as a result of performing 3-gram congestive 3-gram hashing until the end of the signature content, all entries present and signature candidate contents and patterns currently introduced are present. It is characterized by performing a matching.

As a result of the pattern matching, a flag (FLAG) value indicating that a signature for the current signature content has already been generated, if it matches exactly, generates a signature including a 5-tuple, and transmits the signature to a process using the signature. Characterized in that.

According to the present invention, the signature clustering method based on the attack signature classification using the bit-vector of the hashing result value uses overlapping hashing when managing rules when multi-pattern matching of one object with respect to a plurality of rules is performed. In comparison with the rule, Consecutive Hashing is applied, and in applying a plurality of rules, the operation is performed corresponding to the hash value of the object so that a specific word is included from a large amount of documents. By finding the text, the time required to perform the task is greatly reduced. In addition, since the present invention can be easily implemented in hardware through bit operation, there is an effect capable of fast pattern matching using hardware.

In addition, the present invention manages the signature candidates as described above, groups a plurality of nodes in response to similarity, generates a signature within the group, and clusters based on the similarity when inserting data. Trees can be formed and operated online to effect real-time processing.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

1 is a view referred to for explaining the configuration of a strong message used in the signature clustering method according to an embodiment of the present invention.

The security system of the present invention searches for a plurality of signature candidate groups by searching corresponding to the number of signature candidate groups, thereby finding a set to which the signature candidates belong. The signature bit-map is used to derive faster search results by different hashing methods for pattern listing and pattern matching.

Accordingly, the signature clustering method may be redefined as a representative signature by applying inclusion to signatures stored in an existing database (DB). In addition, as the number of signatures increases, Approximate Pattern Matching is performed to use pattern matching in the security system, and Exact pattern matching is applied to the result.

In the security system of the present invention operating as described above, when a powerful message having a structure as shown in FIG. 1 is input, the signature system is hashed and clustered to generate a signature.

The signature of the security system is an ASCII code value or a string as shown in FIG. 1 (10, 11-18). The security system uses shortened bits of objects that can replace these ASCII codes or strings (10, 11-18) rather than storing all the values of such data.

In this case, the security system does not have all the strings of strings such as Jaccard index (Jaccard index, Jaccard similarity coefficient), and determines similarity and inclusion using only the abbreviated information.

The security system has a similarity between A and B when a document A and a document B containing a string exist, having a value between 0 and 1. The similarity is calculated by the following equation (1). That is, the similarity can be calculated as an absolute value for the ratio of the union and intersection of the documents A and B.

In addition, based on the similarity calculated as described above, the security system calculates the logical distance between the document A and the document B using the following equation (2).

The security system calculates the probability that document A is included in document B using Equation 3 according to the above formula. In this case, the inclusion of documents A and B in the security system has a value between 0 and 1.

In order to calculate similarity and inclusion as described above, the security system of the present invention first performs a task of separating each document into tokens in units of characters, words, and lines.

The security system constructs a tokenizer to tokenize a document as described above, and recognizes each input document as a continuous token of a predetermined pattern.

In this case, in order to apply the token to the signature, the contents 11 to 18 of each row in FIG. 1 are defined as one content, and the multi-signature 10, which is the entire signature, is mapped and applied to the document.

Accordingly, the security system groups and collects subsequences, which are individual contents 11 to 18, and configures the signature 10 as a multi-content set.

The system of the present invention operates based on a dataset classified as the content of suspicious traffic for the traffic of the network. In this way, a process of repeatedly managing the generated data set through 3-gram hashing according to the contents of the contents is performed.

This procedure includes clustering every predetermined time, and clustering by similarity calculated, and generating one signature for the clustered signature candidate group.

The signature generated in this way is registered in the signature pool (SP), performs content matching on all incoming contents thereafter, extracts 5-tuple information including a corresponding signature, and extracts the current tuple information to the currently flowing packet data. It can help you do a detailed analysis.

The present invention utilizes a bit-vector value having a result of hashing to manage and cluster a large number of signature candidate groups for repeated content generated from 5-tuples selected as suspicious traffic to generate such a signature. Candidates are generated and these results allow for real-time processing of similarity-based clustering on-line at regular intervals.

In addition, in the present invention, even if a large amount of traffic flows through prior confirmation whether one signature is included in another signature, it helps in data management. In addition to generating signatures, 5-tuple information is simultaneously transmitted with signature information at the time when traffic flows so that traffic data including the contents of the signature can be captured.

2 is a diagram referred to for describing a hashing method used in a signature clustering method according to an embodiment of the present invention. FIG. 2A is a diagram illustrating overlapping hashing, and FIG. 2B is a diagram illustrating concentric hashing.

The security system uses two hashing methods to apply 3-gram hashing.

The security system uses an overlapping 3-gram hashing 51 method that moves by 1 byte according to a sliding window technique to form a hashing table for a pattern to be used as a rule, and a bit including a rule. It uses a 3-byte sliding 3-gram hashing (52) scheme used to compare the contents of the bit table with the current contents one by one.

The security system uses overlapping 3-gram hashing (51) for the same character string to generate a hash value for the 3-byte super-alphabet and a 9-2 hash value for a string of size 9. And a hash value for the Consecutive 3-gram Hashing (52) 3-byte super-alphabet to generate 9/3 hash values for a string of size 9.

For example, in the case of the overlapping hashing 51 to which the sliding window is applied as shown in FIG. 2 (a), the size of a string according to hashing is specified for the input data, and the first window is '85 , ff, 53 ', the second window is set to ff, 53, 4d, and the third window is set to '53, 4d, 42' and hashing is performed.

On the other hand, as shown in (b) of FIG. 2, in the case of the concatenated hashing 52, the first window is hashed by dividing the first window into '85, ff, 53 'and the second window by' 4d, 42, 72 '. This is done.

If the security system generates more hash values for the pattern set to be used as a rule as described above, the value of the current string to be compared with the existing rule can reduce the number of operations.

3 is a diagram referred to for describing a structure of a bit vector table used in the signature clustering method according to an embodiment of the present invention.

When the hash value is calculated using the hash method of the two methods of FIG. 2 described above, the security system sets 1 to the corresponding memory area of the bit vector table configured as shown in FIG.

When the hash value is formed, the security system stores the hash value in the bit vector memory of the form shown in FIG.

Here, the X-axis 62 is a signature index, and means a management index of a signature or signature candidate inserted in a bit-vector table as a rule. The Y axis 63 represents a range (0 to MAX-1) of hashing result values predefined by the two hash function algorithms.

The bit-vector table is used to manage the signature candidates, and is also used to manage each signature pattern present in the signature pool SP.

4 is a flowchart of an operation description according to a node management method based on signature inclusion according to an embodiment of the present invention.

With respect to the incoming packet (S110), a strong message (Prevalent MSG) is extracted (S120). At this time, a message (Prevalent MSG) is managed for each destination port.

In the case of the first message of the current port (S130), since the bit vector table managing the existing pattern is in an initial state, registration is performed for the message (Prevalent MSG).

Overlapping hashing is performed (S140), and the signature candidate bit vector table is updated using the hash value (S150). The above hashing and signature candidate bit vector table update is repeated until the end (S140 to S160).

At this time, a 3-gram overlapping hashing process is performed by applying a sliding-window technique of shifting the message (Prevalent MSG) data by 1 byte, and the resulting hash value is a bit-vector. Update to the corresponding area of the table.

In the case of the first rule, it is positioned at the first of the X column 62, and when the generation range of the hashing result value is 1M, the maximum value MAX of the Y column 63 of the bit-vector is 1M-1. The hashing result can be readjusted considering the degree of collision. Overlapping hashing with 1-byte shift sliding window and update of the bit vector table are applied until the end of the message (Prevalent MSG). Once the hashing has been completed to the end of the message (Prevalent MSG), the loop exits.

If it is not the first message, Consecutive 3-gram Hashing) is performed on the message (S170). According to the hashing result, the hash value is retrieved from the bit vector table of the signature candidate map (S180).

 At this time, if the hash value does not exist as a result of the inquiry, it means that it is not included in the existing signature candidate group. Since the signature candidate must newly register a value in the bit-vector table, the signature candidate performs a registration procedure for the message (Prevalent MSG) as described above (S140).

On the other hand, if there is a hash value as a result of the search, the index values of the X column 602 searched by Active are stored in the current result table (S200). By intersecting the stored value and the result table with all bits initially set to 1 (and performing a logical operation), the index values of the X column 62 to be searched are tracked.

If the hash value of Consecutive 3-gram Hashing is not present in the current result table or the entire result table during the loop, the contents of the current message (Prevalent MSG) are stored in the existing pattern database (DB). Not shown (S210 to S260).

5 is a flowchart of an operation description according to a signature candidate management method based on similarity of signatures according to an embodiment of the present invention.

The security system of the present invention manages the signature candidate using the similarity item to determine the similarity between each object when performing clustering among the above features.

The security system clusters all contents and then performs hierarchical clustering of bottom-up. At this time, in order to use this method, each cluster should be configured. Therefore, after batching off-line and clustering the result, the clustering is performed. Determine a false positive rate as applicable for the signature.

As shown in FIG. 5, when a new signature content is introduced (S310), a generation time is recorded when the first signature candidate is introduced for each port. This recorded time is compared with the signature full reset time (SP_reset), signature candidate node reset time (SG_reset), maximum number of signature nodes (SG_MAX), and clustering time (CL_time). Take appropriate action.

If the elapsed time is greater than the signature pool reset time SP_reset (S320) (S320), the signature pool (SP) and the signature group (SG) of the current destination port are reset (S330). In operation S340, each structure of the corresponding object is free from memory. After the end of the current process, it waits to receive the next signature content.

On the other hand, if the elapsed time is not greater than the signature full reset time (SP_reset) and the elapsed time is larger than the signature candidate node reset time (SG_reset) due to the inflowed signature content (S350), the occurrence frequency in the signature group of the current destination port The (Hit_count) value is reset for signature candidate nodes having a frequency threshold value equal to or less than Hit Threshold / 2 (S360), and the associated linked list is managed.

The signature node to be reset is distributed in the memory (S370) and deleted from the linked list, so that the next node of the current node is located next to the next node. Terminate the current process and wait to receive the next signature content.

Here, when the number of signature candidate nodes is larger than the predefined maximum number of nodes MAX_node (S380), the signatures are managed and the memory is released. The process then terminates and waits to receive the next signature content.

If the number of signature candidate nodes is larger than the predefined maximum number of nodes MAX_node (S380), the following is the case.

6 is a flowchart referred to for describing an operation according to the signature candidate clustering method according to an embodiment of the present invention.

Referring to FIG. 6, when the elapsed time is greater than the clustering time CL_time (400), the frequency of occurrence (Hit_count) is high for the list of signature groups SG by the inflowed signature content S310 (FIG. 4). Nodes larger than the threshold value Hitth_th are extracted (S410) to form a separate linked list.

When the number of nodes existing in the formed list is a predetermined number (M), a similarity table is formed with respect to the number of nodes (S420).

The generated similarity value forms a group in the form of a linked list for nodes having a larger value than the similarity limit value (resemble_th) (S430). The next group is managed with the pointing position in the current group.

Longest Common Subsequence (LCSeq) is performed between two nodes for nodes belonging to one grouping (S440) to generate a string set based on a commonly occurring sequence. At this time, LCSeq is one of pattern recognition algorithms for extracting the same character string. The LCSeq extracts the longest character string among a plurality of identical character strings, and considers the same character strings in order. By extracting the longest string, the signature can be extracted even if some packets are fragmented or slightly changed, and it is possible to search for the same non-contiguous string.

Through this, one signature candidate in a grouped group is presented as a result. The signature candidate thus generated checks the similarity with the signature in the existing signature pool SP in order to register with the signature pool SP managing the signature (S460).

As a result, when there is an existing signature having similarity or more than the similarity, the LCSeq (Longest Common Subsequence) of the existing signature and the current signature is performed (S470), and the result is placed in the signature pool (SP) where the existing signature is located. Register (S480).

As a result of checking the similarity between the signature in the signature pool SP and not greater than the similarity, the signature generated by the current grouping is registered in the signature pool SP (S480).

When registering to the signature pool SP, in order to update the signature bit-vector table, a 3-gram overlapping hashing is performed (S490), and the result is updated in the signature bit-vector table ( S550).

If there is more 3-gram data, 3-Lapping 3-gram hashing is performed again (S510), otherwise, the current process is terminated to receive the next signature content.

7 is a flowchart referred to for describing an operation according to the final signature clustering method according to an embodiment of the present invention.

Referring to FIG. 7, after a new signature is introduced, two streams are managed by the signature pool SP managing the signature set in a state in which the conditions of FIGS. 5 and 6 are not satisfied (B).

First, when the signature pool SP is not empty (S560), the signature content and the pattern matching may be performed with the signature content currently flowing in the existing signature pool SP.

When performing such pattern matching, even if there is a predetermined number M of signatures in the signature pool SP, the pattern matching is not performed as much as the corresponding number M, but it uses less memory and provides faster computing time. The method used in FIG. 4 to provide applies to this part.

In order to proceed with comparing the hash value registered in the signature bit-map by the signature content registered in the signature pool (SP), 3-gram Consistent 3-gram Hashing is performed until the end ( S660).

By this procedure, if the pattern matching current result table is not null (S670) or if the pattern matching result table is not null (S680), the operation is repeated until the end of the 3-gram data (S690). , S660 to S690).

If the entire result table is not null (S700) as a result of performing 3-gram congestive 3-gram hashing to the end of 3-gram data, that is, an entry corresponding to the signature bit-vector map If is present, all existing entries and the signature candidate contents and pattern matching currently introduced are performed (S710).

As a result, if it matches exactly (S720), a flag (FLAG) value indicating that a signature for the current signature content has already been generated is set (S730), and a signature including a 5-tuple is generated to generate a signature. Send to process to use.

Then, the process ends to receive the incoming signature content (S750). The reason for setting the signature generation flag FLAG is to prevent the repetition of signature generation until the signature full reset time SP_reset is applied.

If the current result table that is pattern-matched by performing 3-gram Consistent 3-gram Hashing is null, or if the entire result table is null after pattern blending, it is determined by the signature pool (SP). It is determined that the signature does not match. In this case, branches to the process of managing signature candidates.

After the new signature is introduced, the signature pool SP does not satisfy the conditions for the signature pool reset time SP_reset, the signature candidate node reset time SG_reset, the signature node, and the like in FIGS. 4 and 5 described above. NULL), or if any of the above conditions are not satisfied, the currently introduced signature content is managed as a signature candidate not included in the signature pool. In this case, in order to proceed with a procedure for querying a bit-vector table for the signature candidate, 3-gram congestive 3-gram hashing is performed (S560).

However, if the current result table is not null (S600) when the end of the 3-gram data is advanced (S600), the frequency of occurrence (hit_count) of the signature candidate node having the corresponding index is increased by one (S650), and the process is performed. To exit.

 If the current result table S570 and the entire result table S580 are not null, the process is repeated until the end of the 3-grams (S590, S560 to S590). If the current result table or the entire result table S600 is null before reaching the end of the 3-gram, this forms a node as a new signature candidate that is not included in the existing signature candidate. To this end, in order to set a hash value corresponding to the signature candidate bit-vector table (S620), a 3-gram overlapping hashing is performed (S610), and the repeat setting is performed until the end of the 3-gram (418). (S630, S610 to S630).

When the above operation is performed until the end of the 3-gram data, the signature candidate is inserted 419 at the end of the linked list having the corresponding destination address of the signature and the process is terminated (S640).

Therefore, when the multi-pattern matching is performed on an object with respect to a plurality of rules, the present invention can be performed with a small amount of memory and a small amount of operations. You can judge.

The present invention uses overlapping hashing when managing a rule, and by applying congestive hashing to an object for comparison with a rule, even if a plurality of rules exist, the current object for comparison Finding the text containing a specific word in a large amount of documents can be performed much faster by causing the operation to occur according to the hashing result generated by the hash.

In addition, since the present invention is a bit-operation that is easy to implement in hardware, it is possible to provide fast pattern matching using hardware, and to check similarity with respect to the managed signature candidates. You can group and present one signature as a result within a group.

In this way, while being performed offline, the present invention provides clustering based on the similarity at the time of insertion of data, whereas the method cannot provide processing on incoming data after clustering. By this procedure, only homogeneous data exists in one tree, and not only online operation but also real-time processing system can be constructed.

As described above, the signature clustering method based on the attack signature classification using the bit-vector of the hashing result according to the present invention has been described with reference to the illustrated drawings, but the present invention is not limited thereto by the embodiments and the drawings disclosed herein. Instead, the present invention may be applied by those skilled in the art.

1 is a reference to the configuration description of a strong message used in a signature clustering method according to an embodiment of the present invention;

2 is a reference to the description of the hashing method used in the signature clustering method according to an embodiment of the present invention;

3 is a diagram referred to for explaining a structure of a bit vector table used in a signature clustering method according to an embodiment of the present invention;

4 is a flowchart referred to for describing an operation according to a method for managing node signature-based nodes according to an embodiment of the present invention;

5 is a flowchart referred to an operation description according to a signature candidate management method based on similarity of signatures according to an embodiment of the present invention;

6 is a flowchart referred to for describing an operation according to a signature candidate clustering method according to an embodiment of the present invention;

7 is a flowchart referred to for describing an operation according to the final signature clustering method according to an embodiment of the present invention.

<Explanation of symbols on main parts of the drawings>

10: signature 11 to 18: content

61, 62, 63: bitvector table

Claims (10)

Extracting, by the security system, a likely message as a signature candidate from an incoming packet; If the message is a first message, overlapping and hashing the message, and updating the bit vector table using the hash value to register the message; If the force message is not the first message, consequently hashing the force message and retrieving the hash value from the bit vector table; And And performing the registration step when the hash value does not exist in the bit vector table as a result of the search, and outputting a processing result when the hash value exists. Resetting, by the security system, the introduced data when the elapsed time is greater than or equal to a preset reference time based on the generation time of the signature content; Generating a signature candidate for the signature content based on a frequency of occurrence and a similarity when the elapsed time is greater than a preset clustering time; And And registering the signature candidate as a new signature in a signature pool (SP) by analyzing the similarity between the signature candidate and a previously registered signature. The method of claim 2, The signature pool or the signature candidate node is reset when the elapsed time is greater than a reference time for at least one of a signature pool reset time, a signature candidate node reset time, and a maximum number of signature nodes. Signature clustering method. The method of claim 2, In the candidate generating step, a separate list is formed by extracting nodes in which the frequency of occurrence (Hit_count) of the list of signature groups (SG) is greater than the frequency limit value (Hitcount_th) from the signature content, and exists in the list. If the number of nodes is more than a predetermined number, the similarity table between each node is formed, And in the similarity table, form a linked list group for nodes having a similarity value greater than a similarity threshold value. The method of claim 4, wherein The candidate generation step includes performing a LCSeq (Longest Common Subsequence) for extracting the same string between two nodes for the nodes in the group, and using the signature set generated based on a commonly occurring sequence as the signature candidate. Signature clustering method characterized in that the generation. The method of claim 5, In the registration step, by analyzing the similarity between the signature candidate and the pre-registered signature, If the similarity between the signature candidate and the pre-registered signature is equal to or greater than a preset similarity, the result of performing the LCSeq (Longest Common Subsequence) for extracting the same character string between the pre-registered signature and the current signature candidate is registered. Register with the signature pool (SP) where is located, And if the similarity between the signature candidate and the pre-registered signature is less than the similarity, registering with the signature pool (SP) as a new signature. The method of claim 6, The registering step may include performing 3-gram overlapping hashing on the signature candidate, and updating the generated hash value in the signature bit-vector table. The method of claim 2, If the elapsed time is less than the clustering time, corresponding to the state of the signature pool SP managing the signature, If the signature pool SP is not empty, 3-gram congestive 3-gram hashing is performed on the current signature content, and the registered signature and pattern matching are performed using the hash value. And determining whether the signature content exists in an existing signature pool (SP). The method of claim 8, The step of checking whether the signature content exists in the existing signature pool (SP) may be performed by performing 3-gram congestive 3-gram hashing until the end of the signature content. If there is at least one entry, pattern matching is performed with all existing entries and the signature content currently imported, If the signature content matches the entry, set a flag FLAG indicating that a signature for the signature content has already been generated, generate a signature including a 5-tuple, and send it to a process using the signature. Signature clustering method characterized in that. The method of claim 9, As a result of performing 3-gram congestive 3-gram hashing until the end of the signature content, at least one entry does not exist in the current result table and at least one entry exists in the entire result table. If you don't either Signature candidate management is performed by determining that the signature content does not match the signature of the signature pool (SP).

Images