JP2008017371A - Character string retrieving apparatus, method and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve security and to shorten a retrieval time by performing pattern matching between both texts containing and excluding OOB data, and to reduce storage capacity and the number of processes rather than the case where retrieval is performed while respectively preparing TCP data excluding the OOB data and TCP data containing the OOB data. <P>SOLUTION: When performing character string retrieval in a state transition, when a character retrieval point reaches OOB data, character retrieval is performed while skipping the retrieval point for one character and when a retrieval result can not be transient, retrieval is started again by returning the retrieval point to a character position before skipping. Thus, character retrieval is performed on both the text in which OOB data are inserted between characters, and the text in which OOB data share the same positions as ordinary characters, in one time of TCP text scanning. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a character string search device, method, and computer program, and more particularly, to a character string search device, method, and computer program including TCP (Transmission Control Protocol) OOB (Out-of-Band) data.

In recent years, from the viewpoint of security, a means for protecting cyber attacks via the Internet has become indispensable. Intrusion detection systems, IDS (Intrusion Detection System), IPS (Intrusion)
Prevention System). By monitoring the data that flows through the Internet, they detect and eliminate viruses, worms, and other data that cause host security vulnerabilities and damage the host.

  These detection methods detect an attack by matching the monitored data with a list of a plurality of attack patterns registered in advance. However, TCP (Transmission Control Protocol), which is a main protocol for data flowing through the Internet, includes OOB data. This is emergency data sent from the sender to the receiver, and is stored in a storage area different from the original data reception buffer.

The OOB data is also referred to as TCP Urgent data. It is obtained from the value indicated by the Urgent Pointer field of the TCP header when the URG flag of the TCP header is set. Many operating systems (Operating
System) defines the 1-byte area of the byte offset next to the value indicated by the Urgent Pointer field as OOB data.

The OOB data to be transmitted is inserted into a TCP data stream. Since the receiver takes out the OOB data indicated by the URG flag and the Urgent Pointer field of the TCP header and stores the OOB data in a buffer different from the normal data stream, the data stream read by the receiver has the OOB data excluded. For this reason, if a malicious sender inserts OOB data between data patterns such as viruses and worms, the recipient can specify the attack pattern of viruses and worms when reading a data stream excluding OOB. It will read. For this reason, IDS and IPS that monitor data must match a pattern excluding OOB data.

  However, the receiving side can also read the OOB data as a normal data stream without changing it from the normal data stream (socket option OOB_INLINE option) by changing the TCP setting of the receiving side. The receiving side cannot know whether the OOB data is read out from the normal data stream or not read out. Therefore, IDS and IPS need to be matched against the attack pattern list by both including and excluding OOB data. Matching against the attack pattern list requires a technique for searching for a plurality of character strings from the text when considering text as data to be searched and a plurality of character strings as the pattern list. An example of a method for efficiently searching a plurality of character strings simultaneously is the Aho-Corasick method (Non-Patent Document 1). This method generates a finite automaton from a list of a plurality of character strings to be searched, and converts it into a text. This is a method of detecting the appearance position of each character string by scanning once from left to right.

  By this method, a plurality of character strings can be searched in the order of the number of characters in the text. Similarly, there is a technique shown in Patent Document 1 in which a plurality of character string patterns are searched for by text. This technology also forms an automaton (state transition diagram) and searches for a plurality of character strings.

However, the conventional technology considers that a single text scan searches for a pattern that needs to be matched both in the character string to be searched and in what is not excluded, such as TCP OOB data. There are two types of text patterns that are excluded and text patterns that are not excluded.
Japanese Patent Application No. Sho 62-231091 Alfred V. Aho and Margaret J. Corasick [Efficient String Matching: AnAidito Bibliographic Search] Communications of the ACM, Vol.18, No6, June1975, pp.333-340

  The first problem is that the processing unit that monitors data on the receiving terminal side cannot know whether OOB is excluded or not. Therefore, when OOB data is included, both the data that excludes OOB data and the text that does not exclude it. Pattern matching is not possible.

  The second problem is that the conventional technique does not assume that OOB data is mixed in the text. Therefore, in order to perform pattern matching on both the text excluding the OOB data and the text not excluding the text, two times are required. Search is required. Further, since a data buffer is required for both the text including the OOB data and the excluded text, a large amount of storage resources is consumed.

  The third problem is that the conventional technology requires a data holding buffer for each of the text including the TCP OOB data and the excluded text, thereby consuming a large amount of storage resources.

  An object of the present invention is to improve security by performing pattern matching on both the text including and excluding OOB data.

  Further, the search time is shortened by performing pattern matching for both TCP data including OOB data and excluded TCP data in one search.

  Further, the storage capacity is reduced as compared with the case where TCP data excluding OOB data and TCP data including OOB data are prepared and searched.

  Further, the number of processes is reduced as compared with the case where TCP data excluding OOB data and TCP data including OOB data are prepared and searched.

  In a first aspect of the present invention, a character string search device of the present invention includes a state transition unit and a control unit, the state transition unit stores text pattern characters and transition states, and externally input characters. Is supplied, the text pattern is searched, the input character and the searched character are compared with each other, and as a result of the search, if they match, a determination output of the next transition instruction is generated. The control unit receives TCP text including TCP OOB data, and sequentially shifts the character search point from the start point to the end point on the received text, and moves the character on the search point to the state transition unit. While searching, the position of the OOB data is searched. As a result, when the determination output of the next transition instruction is obtained from the state transition unit, the search point is shifted by one character in the direction of the end point, and before the OOB data is detected. The When a determination output indicating that the transition is not possible is obtained from the state transition unit, a collation failure output is generated, and when the OOB data is detected, the next character of the OOB data is supplied as a search character to the state transition unit and the determination output cannot be transitioned. In the case of the above, the character at the position of the OOB data is supplied to the state transition unit as the search character to the state transition unit, and a verification failure output is generated when the judgment output of the state transition unit cannot transition after the detection of the OOB data When the end point is displayed, a collation success output is generated.

  In the second aspect of the present invention, the character string search device of the present invention includes a state transition unit and a control unit, the state transition unit stores each character of the text pattern and its transition state, and is input from the outside. When a character is supplied, the text pattern is searched, the input character and the searched character are compared with each other, and as a search result, a determination output of a next transition instruction is generated if they match, and a determination that transition is not possible if they do not match The control unit receives TCP text including TCP OOB data, and sequentially shifts the character search point from the start point to the end point on the received text, and moves the character on the search point to the state transition unit. The position of the OOB data is searched while being supplied to the state. As a result, when the determination output of the next transition instruction is obtained from the state transition unit, the search point is shifted in the direction of the end point by one character, before the OOB data is detected. In When a transition impossible determination output is obtained from the state transition part, a collation failure output is generated. When the determination output of the state transition part cannot transition at the time of detection of the OOB data, one character from the search point in the direction of the end point A character at the transitioned position is supplied as a search character to the state transition unit, and after the OOB data is detected, if the determination output of the state transition unit is not transitionable, a verification failure output is generated, and the end point is displayed Generates a successful output.

In a third aspect of the present invention, a character string search device of the present invention comprises an operation mode setting unit for setting mode 0 or mode 1, a state transition unit, and a control unit, and the state transition unit is a text pattern. When the input character is supplied from the outside, the text pattern is searched, and the input character and the searched character are collated with each other, and if the search result matches, the next transition instruction is stored. If there is no match, it generates a determination output indicating that transition is not possible. The control unit receives TCP text including TCP OOB data, and sets a character search point from the start point to the end point on the received text. The position of the OOB data is searched while sequentially shifting and supplying the character on the search point to the state transition unit. As a result, when the determination output of the next transition instruction is obtained from the state transition unit, the search point is set to one character. When the transition is made to the end point and a determination output indicating that the transition is not possible is obtained from the state transition unit before the OOB data is detected, a collation failure output is generated. When the control unit is in mode 0, when the OOB data is detected When the next character of the OOB data is supplied to the state transition unit as a search character and the determination output is not transitionable, the character at the position of the OOB data is supplied to the state transition unit as the search character to the state transition unit. In mode 1,
If the determination output of the state transition unit is not allowed to transition at the time of detection of the OOB data, the search point is supplied to the state transition unit as a search character at the position where the search point has shifted in the direction of the end point, and the OOB After the detection of data, when the determination output of the state transition unit is not transitionable, a collation failure output is generated, and when the end point is displayed, a collation success output is generated.

  In a fourth aspect of the present invention, the character string search method of the present invention stores each character of a text pattern and its transition state, searches for the text pattern when an input character is supplied from the outside, In a system including a state transition unit that collates the searched characters with each other and generates a next transition instruction output as a search result if they match, and generates a transition impossible display output if they do not match, (a) TCP OOB data (B) searching the OOB data while sequentially shifting the character search point from the start point to the end point on the received text; and (c) using the character at the search point as a search character. The state transition unit is supplied to determine the output of the state transition unit, and when the determination result is a next transition instruction, the next character is supplied as a search character to the state transition unit, and (d) the OOB If the determination result of (c) indicates that the transition is not possible before the data is detected, a collation failure output is generated. (E) When the OOB data is detected, the next character of the OOB data is used as a search character. Returning to (c), if the determination result is display indicating that transition is not possible, the character at the position of the OOB data is used as a search character in the state transition section, and the processing returns to (c). (F) After detecting the OOB data, A collation failure output is generated when the determination result is display indicating that transition is not possible, and a collation success output is generated when the end point is displayed.

  In a fifth aspect of the present invention, the character string search method of the present invention stores each character of a text pattern and its transition state, searches for the text pattern when an input character is supplied from the outside, In a system including a state transition unit that collates the searched characters with each other and generates a next transition instruction output as a search result if they match, and generates a transition impossible display output if they do not match, (a) TCP OOB data (B) searching the OOB data while sequentially shifting the character search point from the start point to the end point on the received text; and (c) using the character at the search point as a search character. The state transition unit is supplied to determine the output of the state transition unit, and when the determination result is a next transition instruction, the next character is supplied as a search character to the state transition unit, and (d) the OOB Before the detection of the data, if the determination result of (c) is display indicating that the transition is not possible, a collation failure output is generated. (E) If the determination result of (c) is not transitionable at the time of detection of the OOB data, the search is performed. Return to (c) using the character at the position shifted from the point in the direction of the end point as the search character, and (f) If the determination result in (c) is not allowed to transition after detection of the OOB data, a verification failure output And when the end point is displayed, a collation success output is generated.

  In a sixth aspect of the present invention, the character string search method of the present invention stores each character of a text pattern and its transition state, searches for the text pattern when an input character is supplied from the outside, In a system including a state transition unit that collates the retrieved characters with each other and generates a next transition instruction output as a search result when they match and generates a transition impossible display output when they do not match, (a) the operation mode is set to 0 or Set to 1, (b) receive TCP text including TCP OOB data, (c) search the OOB data while sequentially shifting the character search point from the start point to the end point on the received text, (D) Supplying the character at the search point as a search character to the state transition unit to determine the output of the state transition unit, and if the determination result is a next transition instruction, the next character as the search character When it is supplied to the state transition unit, (e) before the detection of the OOB data, if the determination result of (c) is a non-transitionable display, a collation failure output is generated, and (f) when the operation mode is set to 0 When the OOB data is detected, the next character of the OOB data is used as a search character, and the process returns to (c). When the determination result indicates that the transition is not possible, the character at the position of the OOB data is searched for in the state transition portion. Returning to (c) above, (g) When the operation mode is set to 1, if the determination result of (d) is a non-transitionable display output at the time of detection of the OOB data, one character from the search point The character at the position shifted in the direction of the end point returns to (d) as a search character, and (h) regardless of the operation mode, the determination result of (d) is (1) non-transitionable after the detection of the OOB data. In case of display, the state transition In step (d), the character at the position of the OOB data is used as a search character to return to (d). When the transition is not displayed, (2) a collation failure output is generated, and (3) when the end point is displayed, a collation success output is generated. It is characterized by doing.

  A first embodiment of the present invention will be described with reference to FIG. The character string search apparatus includes an automaton state transition unit 104 in which a plurality of search patterns are stored as a finite state automaton (state transition diagram), a control unit 100 including an automaton processing request unit 102 and an automaton processing unit 103, and the automaton. The data buffer 105 temporarily stores output data of the processing unit.

As shown as an example in FIG. 4 to be described later, the state transition unit 104 has an “insertion type or OOB type” text (virus) in which control data is inserted at a dedicated character position, and the control data and normal data have the same character position. Each character of a plurality of text patterns such as “shared or inline type” text (worm) to be shared and its transition state are stored, and each character of the input text 1 supplied from the control unit 100 and each of the stored characters are stored. Compares the characters with each other. As a result, if there is a character that can make the next transition, a decision output that indicates the next transition is generated. When the search point reaches the start point of the text, an end flag is generated. This end flag means that the pattern matching has been successful.
Note that, as will be described later, in the present invention, a determination output indicating that transition is not possible in the search process does not necessarily mean that pattern matching has failed.

  When the control unit 100 obtains the TCP text 101 including the TCP OOB data, the control unit 100 scans the input text while shifting the search point character by character. The control unit 1000 searches the position of the OOB data while sequentially shifting the search point on the text, and supplies the character on the search point to the state transition unit 104. As a result, when the determination output of the state transition unit 104 indicates the next transition, the search point is advanced to the next character position. On the other hand, the control unit skips the OOB data position by advancing the search point by one character toward the end point when the position of the OOB data is detected. Therefore, in the first embodiment, the control unit does not obtain the determination result from the state transition unit 104 for the OOB data. When the determination output of the state transition unit 104 indicates that the transition is not possible immediately after the search point is advanced in the direction of the end point by one character in this way, the control unit 1000 moves backward to a position obtained by subtracting the search point by one character from the next character position. Let

  By executing such a search process from the start point to the end point of the character string, the “insert type” text in which the TCP OOB data is inserted at the dedicated character position, the OOB data, and the normal data share the same character position. Any “shared” text can be pattern matched in a single search scan.

  Next, FIGS. 2 and 3 are flowcharts showing the operations of the automaton processing request unit 102 and the automan processing unit 103 constituting the control unit 100, respectively. In the search process to determine whether or not the input TCP text 1 matches the search pattern, the automaton processing request unit 102 first supplies the input value to the automaton processing unit 103, and then the processing unit 103 sets the character string of the input text in character units. The result is supplied to the state transition unit 104 and the determination result is acquired from the character string of the search pattern and the state transition unit.

In FIG. 2, the automaton processing request unit 102 first acquires the TCP text “T” and the OOB data offset “U” indicating the position of the OOB data field from the input TCP text 101 (step 201), and then in step 202. A plurality of initial values of the automaton processing unit 103 are set. That is, the input TCP text 1 is set in the input TCP text T, and the value “U ₀ ” of the Urgent pointer field of the TCP header when the Urgent flag of the TCP data is set in the OOB data offset “U” is set. In the character string offset “P” and the automaton state “S”, an offset value “P ₀ ” and an initial state “S ₀ ” indicating the position of the first character of the TCP text are set.

  Next, in FIG. 3, the automaton processing unit 103 responds to the supply of initialized input data (TCP text “T”, OOB data offset “U”, search character string offset “P”, automaton state “S”). In step 301, the flag “i” is set to 0. In step 302, the OOB data offset “U” and the search character string offset “P” are compared to determine whether or not they are equal to each other. When the search (scanning) point on the text comes to the position of the OOB data field, the OOB data offset “U” and the character string offset “P” become equal to each other. If the determination in step 302 is NO, the flow proceeds to step 303; if YES, the process proceeds to step 307 and the flag “i” is set to 1. In step 308, the current character string offset P and the transition state are stored in the data buffer 105. S is written, 1 is added to the character string offset P in step 309, and the process proceeds to step 303.

  In step 303, the processing unit 103 supplies data T, P, S to the state transition unit 104, and acquires a search result from the state transition unit in step 304. In the next determination step 305, the processing unit 103 checks the determination output as the search result. If the determination output is a transition instruction (transition possible), the state transition unit 104 outputs the next character string offset P_o as output data. And the next transition state S_o is obtained. The next input value of the state transition unit 104 is reinitialized with these values (step 306), and the process proceeds to the determination step 310 to determine whether the flag “i” is 0 or 1. If the flag “i” is 0, the OOB data has not been detected yet, so the flow returns to Step 302. If the flag “i” is 1, the OOB data has already been detected, and the flow proceeds to Step 303. .

If the determination result in step 305 is not transitionable, the flow returns to determination step 203 (FIG. 2) and refers to the data buffer 105 to check for data. If no data is stored, an output indicating “pattern matching unsuccessful” is supplied to the output unit 106. If data is stored in the data buffer 105, the process proceeds from step 203 to step 204 to use the stored data. The input value of the automaton processing unit 103 is reinitialized, and the process returns to step 310 (FIG. 3). Since the reinitialized data is data when the OOB data offset “U” and the search character string offset “P” are equal to each other, the input value of the processing unit 103 is the character string offset P _{(U = P)} , the automaton state S _{(U = P)} .

  If the determination result in step 305 is an end flag, the pattern matching has succeeded, and the flow supplies an output of “pattern matching success” to the output unit 106 in step 206 (FIG. 2).

  In the case of an OOB “insertion type” text, the state transition unit 104 outputs a search result for all normal characters by the “OOB position jump search” by the automaton processing unit 103. On the other hand, in the case of an OOB “shared type” text, the state transition unit 104 outputs “non-transitional” for the next normal character after the OOB position for this “interlace search”, and as a result, the automaton processing unit 103 sets the search point. Retract to the OOB position. By this backward search, the state transition unit 104 generates a normal search result for the OOB “shared type” text.

  Next, the operation of the first embodiment will be described with a specific example. Referring to (a) of FIG. 4, “virus” and “worm” are assumed as character string patterns to be detected. The automaton AT is stored in the state transition unit 104 from these two character string patterns.

  An example of the matching operation of the “OOB insertion type” input character string EX1 in which OOB data is inserted between characters as shown in FIG. In other words, the character string is “virous”, and “o” is OOB data.

  The initial values that the automaton processing request unit 102 supplies to the processing unit 103 when this character string is input are OOB data offset U = 3, search character string offset P = 0, and automaton state S = 0.

Next, when the input to the state transition unit 104 shown below is performed and transition is possible, the processing unit 103 acquires the next automaton state S_o and the next search character string offset P_o as the transition instruction output.
First input: Automaton state 0, search string offset 0
Output: Automaton state 1, search string offset 1
Second input: Automaton state 1, search string offset 1
Output: Automaton state 2, search string offset 2
3rd input: automaton state 2, search string offset 2
Output: Automaton state 3, search string offset 3
Since the search character string offset P and the OOB data offset U are equal to each other at the third output time of the state transition unit 103 (step 302), the search character string offset (P = 3) and the automaton state (S = 3) are stored as data. Write to the buffer 24 (step 308) and advance the character string offset P by one (step 309). As a result, the next search character string offset P becomes 4.
4th entry: automaton state 3, search string offset 4
Output: Automaton state 4, search string offset 5
5th entry: automaton state 4, search string offset 5
Output: Automaton state 5, result: "End"
As described above, in the fifth request, the input TCP text EX1 matches the text pattern “virus”.

  Next, in FIG. 4 (c), the [EX type] text EX2 in which the OOB data is included in the position of the normal character, that is, the character string is “worm”, and “o” of these is TCP. An example of OOB data is shown.

When the TCP text is entered, the automaton processing request unit 102 sets the initial values of the processing unit 103 to OOB data offset U = 1, search character string offset P = 0, and automaton state S = 0. Next, the following inputs and outputs are generated between the processing unit 103 and the state transition unit 104.
First input: Automaton state 0, search string offset 0
Output: Automaton state 6, search string offset 1
Since the search character string offset P becomes equal to the OOB data offset U at the time after the first request to the state transition unit 104,
The processing unit 103 writes P = 1 and S = 6 to the data buffer 105 (step 308), and advances the character string offset P by one (step 309). As a result, the next search character string offset P becomes 2.
Second time input: Automaton state 6, search string offset 2
Output: Transition not possible (= non-matching)
Since there is no automaton state that can be transitioned at the time of the second input,
An output indicating “non-transition possible” is supplied from the state transition unit 104. Immediately after that, since the data is stored in the data buffer 105 (step 203), the automaton processing request unit 102 retrieves this, and sets the search character string offset “P” to the offset value “1” of the OOB data, and the automaton state. “S” is reinitialized to the state “6” when the OOB offset is detected (step 204), and the process returns to step 303. As a result, the automaton processing unit 103 resumes the search process and performs the following processing with the state transition unit 104.
3rd input: automaton state 6, search string offset 1
Output: Automaton state 7, search string offset 2
4th entry: Automaton state 7, search string offset 2
Output: Automaton state 8, search string offset 3
5th entry: Automaton state 8, search string offset 3
Output: Automaton state 9, "end flag"
As described above, it is found that the input TCP text of EX2 matches the pattern “worm” after five processes.

  As described above, pattern matching of both “OOB insertion type” and “OOB shared type” TCP texts is completed in one search scan. Furthermore, even if two types of TCP texts are not prepared, both can be searched simply by preparing a temporary state storage area when the search character string offset is on the OOB data. There are few storage resources.

Next, a second embodiment of the present invention will be described with reference to FIGS. Referring to FIG. 5, the difference between the character string search apparatus of the second embodiment and FIG. 1 is that the data buffer 105 is not used, and the control unit 500 is connected to the automaton processing request unit 501, the first automaton processing unit 502, and the second. It is configured by the automaton processing unit 503. The automaton processing request unit 501 of the second embodiment requests the first automaton processing unit 502 only once.

  In FIG. 6, the automaton processing request unit 501 obtains the TCP text “T” and the OOB data offset “U” indicating the position of the OOB data field from the input TCP text 101 (step 601). A plurality of initial values T, U, P and S of the unit 502 are set.

  In FIG. 7, the first automaton processing unit 502 sets the flag “i” to 0 in step 701, checks the OOB data position in step 702, and if not U = P, sets T, P, and S in step 703. The search is supplied to the state transition unit 104, a search is requested, the search result is acquired in step 704, and the result is determined (step 705). If transition is possible, the output value of the transition instruction is acquired and the determination step 707 is reached. If the flag “i” is 0, the determination step 702 is executed again. The above processing is repeatedly executed until OOB data is input. When the determination output indicating that the transition is impossible is received from the state transition unit 104, the first automaton processing unit 502 proceeds from step 705 to step 603 (FIG. 2), and the automaton processing request unit 501 outputs "pattern matching unsuccessful" to the output unit 106. Is done.

  In FIG. 7, when the search point reaches the OOB data position, U becomes equal to P in step 702, the first automaton processing unit 502 proceeds from step 702 to step 708, sets the flag “i” to 1, and sets the current value. (T, P, S) is passed to the second automaton processing unit 503 as an argument to start the processing unit (step 709), and the process proceeds to step 703.

  In FIG. 8, the second automaton processing unit 503 stores the P and S values received from the first automaton processing unit 502 in step 801 in a memory, adds 1 to P in step 802, and the state transition unit 104 in step 803. The input value set to is supplied and the search result is obtained (step 804). In step 805, the search result is determined. If transition is possible, the output value of the transition instruction is acquired, and the process returns to step 803. The above processing is repeatedly executed each time each character after detecting the OOB data matches the corresponding character in the pattern.

When a determination output indicating that the transition is impossible is returned from the state transition unit 104 in Step 805, the process returns to Step 603 (FIG. 6). When the end flag is detected in step 805, the process returns to step 604 in FIG. 6 to output “pattern matching success”.

  As described above, in the second embodiment, since pattern matching processing can be performed in parallel by a plurality of processing units starting from OOB data, the TCP text is scanned either when the OOB is excluded or not. It will be the same as the time you did.

A character search device according to a third embodiment of the present invention will be described with reference to FIGS. As shown in FIG. 9, the character search apparatus includes a search mode selection unit 901, and the setting unit is connected to the automaton processing request unit 902 of the control unit 900, and the automaton processing unit 903 is the same as in the first embodiment. Is provided between the processing request unit 902 and the state transition unit 104. The search mode selection unit 901 selects one of the operation modes 0 and 1. When “0”, the character search device searches without excluding OOB data, and jumps (excludes) the OOB data position when a transition is impossible. To resume the search.

  On the other hand, in the case of “1”, as in the first embodiment, the OOB data is first skipped and searched, and immediately after that, when the transition is impossible, the search returns to the OOB data position and the search is resumed. That is, in the case of mode 0, “search without skipping OOB data (that is, search including OOB data)” is prioritized over “search skipping OOB data”. “OOB data interlaced search” is a mode that has priority over “OOB data non-interlaced search”.

Referring to FIG. 10, the automaton processing request unit 902 acquires the TCP text T and the OOB data offset U from the input TCP text 101 (step 1001) as in the first embodiment, and in step 1002, the automaton processing unit 903
The initial value is set, and the processing unit is activated.

  When the automaton processing unit 903 is activated at step 1101 in FIG. 11, the flag “i” is set to 0, the OOB data position is checked at step 1102, and if U = P, T, P, and S are set at step 1103. The search is supplied to the state transition unit 104 and a search is requested. The search result is acquired in step 1104. The result is determined (step 1105). If the transition is possible, the output value of the transition instruction is acquired. The initial value is reinitialized to the output value of the transition instruction, and the process proceeds to decision step 1107 to determine whether the flag “i” is 0 or 1. If the flag “i” is 0, the determination step 1102 is executed again, and the above processing is repeatedly executed until OOB data is input.

  When the search point eventually reaches the OOB data position, U = P is set in step 1102, i = 1 is set in step 1108, and then it is determined whether the mode M is 0 or 1. If 0, step 1103 is set to 1 If so, the process proceeds to step 1110, P and S values are written to the data buffer 105, 1 is added to the value of P (step 1111), and the process proceeds to step 1103 to supply T, P, and S to the state transition unit 104 and search is performed. In step 1104, the search result is acquired from the state transition unit 104, and the result is determined (step 1105). If the determination in step 1105 is “impossible to transition”, the processing unit 903 returns to the determination step 1003 in FIG.

  In FIG. 10, the processing request unit 902 determines the presence / absence of data in the data buffer 105 at step 1003, and if it is determined that there is data, the next determination step 1004 determines whether the mode M is 0 or 1.

If M = 1, the processing request unit 903 proceeds to step 1005, extracts the values of P and S from the data buffer 105, reinitializes the input value of the automaton processing unit 103, and returns to step 1107. The reinitialized data is data when the OOB data offset “U” and the search character string offset “P” are equal to each other. The input value of the processing unit 103 is the character string offset P _{(U = P)} , the automaton state. S _{(U = P)} .

For M = 0, the processing request unit 903 ^{is re-initialized} this string offset P _{(U = P + 1)} to a value obtained by adding 1 to retrieve the value of P from the data buffer 105 proceeds to step ^{1006, then S The value is taken out and reinitialized to the value P, and the} automaton state S _{(U = P)} is set. If the determination in step 1103 is no data, the process request unit 903 proceeds to step 1007 and outputs “pattern matching unsuccessful” to the process request unit 902.

  On the other hand, in FIG. 11, when the processing request unit 903 receives the end flag from the state transition unit 104 (step 1105), the processing request unit 903 notifies the processing request unit 902 that the end flag has been received. In response to this, the processing request unit 902 transmits a “pattern matching success” signal to the output unit 106 (step 1008, FIG. 10).

  The operation of the third embodiment in the mode 0 using the automaton AT and the input texts EX1 and EX2 in FIG. 4 will be described with reference to FIG. The operation in mode 1 is the same as that in FIG.

  The initial values supplied to the processing unit 903 by the automaton processing request unit 902 when the input character string “virous” shown in FIG. 12B is input to the automaton AT shown in FIG. Similarly, OOB data offset U = 3, search character string offset P = 0, and automaton state S = 0.

Next, the processing unit 903 obtains the next automaton state S_o and the next search character string offset P_o as a transition instruction output if input is supplied to the state transition unit 104 shown below and transition is possible.
First input: Automaton state 0, search string offset 0
Output: Automaton state 1, search string offset 1
Second input: Automaton state 1, search string offset 1
Output: Automaton state 2, search string offset 2
3rd input: automaton state 2, search string offset 2
Output: Automaton state 3, search string offset 3
4th entry: automaton state 3, search string offset 3
Output: Transition not possible The state transition unit 903 detects OOB data with this fourth input (i = 1), and the judgment output at Step 1105 (FIG. 11) becomes impossible to transition, so at Step 1006 (FIG. 10). 1 is added to the character string offset P, and the next search character string offset P becomes 4.
5th entry: automaton state 3, search string offset 4
Output: Automaton state 4, search string offset 5
6th entry: automaton state 4, search string offset 5
Output: Automaton state 5, "End flag"
At the sixth request as above,
The input TCP text EX1 matches the text pattern “virus”.

Next, when the character string EX2 (worm) in FIG. 12C is entered, the automaton processing request unit 902 uses the initial value of the processing unit 903 as the OOB data offset U = 1 and the search character string offset P as in FIG. = 0, automaton state S = 0. Next, the following inputs and outputs are generated between the processing unit 903 and the state transition unit 104.
First input: Automaton state 0, search string offset 0
Output: Automaton state 6, search string offset 1
Second input: Automaton state 6, search string offset 1
Output: Automaton state 7, search string offset 2
3rd input: Automaton state 7, search string offset 2
Output: Automaton state 8, search string offset 3
4th entry: Automaton state 8, search string offset 3
Output: Automaton state 9, "end flag"
In this way, the search result of the input character string “worm” is determined by four processes.

  This third embodiment is convenient when it is known in advance which of the patterns excluding OOB data and the patterns not excluded should be prioritized for a TCP stream to be subjected to pattern matching.

  Next, a fourth embodiment of the present invention will be described with reference to the drawings. The state transition automaton used for character string pattern search is a known DFA (Deterministic Finite Automaton), which is a finite automaton that uniquely determines the next state to be transitioned by the state and input, and the next transition destination is uniquely determined. It is divided into two types of known NFA (Nondeterministic Finite Automaton). In this embodiment, in the case of an NFA in which the next transition destination is not uniquely determined, information on the transition branch point is stored in a state holding unit called “backtrack stack”, and the process proceeds to one of the transition destinations. After the process is completed, the backtrack stack information is acquired and another transition destination from the transition point is traced.

  Assume that the pattern to be detected in the present embodiment is a regular expression pattern “([ab] * c) * ad”. (Here, the regular expression “[ab]” is either a or b, and * indicates zero or more repetitions of the previous expression.) When the automaton state is 0, the character of the search string offset is “a ", There will be both a path to transition to state 1 and a path to transition to state 2, and the next transition state is not uniquely determined. When the character string “ab” is input, the operation requested to the state transition unit 104 is as follows.

An example is shown in FIG. Assuming that there are two transition destinations (state 1 and state 2) for the same character “a” when the initial value is automaton state 0 and search character string offset 0, automaton state 0 and character string offset that are the current state 0 is stored in the backtrack stack, and one of them, state 1 is arbitrarily selected as a transition destination and a transition is made.
First input: “S = 0”, “P = 0”
Output: “S_o = 1”, “P_o = 1”
Second time input: “S = 1”, “P = 1”
Output: Transition impossible Since there is no transitionable automaton state at the second input time, the state transition unit 104 determines that transition is not possible and reads “S = 0” and “P = 0” from the backtrack stack, Transition to state 2.
3rd input: “S = 0”, “P = 0”
Output: “S_o = 2”, “P_o = 1”
4th input: “S = 2”, “P = 1”
Output: “S_o = 3”, end flag In the fourth embodiment, the temporary state when the search character string offset is on the OOB data coexists in the backtrack stack used in the NFA.

  Referring to FIG. 13, this embodiment is different in that a backtrack stack 1301 is used instead of the OOB data buffer 105 of FIG. 1 existing in the first embodiment. The control unit 1300 of the character string search apparatus according to the fourth embodiment fetches data from the backtrack stack 1301 instead of the data buffer 105 used in the first embodiment and performs reinitialization. The control unit includes an automaton processing request unit 1302 and an automaton processing unit 1303.

  In FIG. 14, steps 1401 to 1406 executed by the automaton process request unit 1302 correspond to steps 201 to 206 executed by the process request unit 103 of FIG. 2, and the processing contents are the same.

  In FIG. 15, the automaton processing unit 1303 sets the flag “i” to 0 in step 1501 in response to the supply of the initialized input data (T, U, P, S), and sets the OOB data offset U in step 1502. The search character string offsets P are compared to determine whether they are equal to each other. If the determination in step 1502 is NO, the flow proceeds to step 1503. If YES, the flow proceeds to step 1511 and the flag “i” is set to 1. In step 1512, P and S are written in the backtrack stack 1301. 1 is added to P, and the process proceeds to Step 1503.

  In step 1503, it is determined whether or not a plurality of transition states exist under the same conditions. If NO, the flow proceeds to step 1506, and if YES, P and S are written to the backtrack stack in step 1504. In 1505, an arbitrary transition state is selected as the next transition destination, and the process proceeds to step 1506.

  In step 1506, the processing unit 903 supplies data T, P, S to the state transition unit 104, and in step 1507, obtains a search result from the state transition unit. The processing unit 903 checks the determination output as the search result in the next determination step 1508. If the determination output is a transition instruction (transition is possible), the state transition unit 104 outputs the next character string offset P_o and the next transition as output data. Get state S_o. These values are used to reinitialize the next input value of the state transition unit 104 (step 1509), and the process proceeds to a determination step 1510 to determine whether the flag “i” is 0 or 1. If the flag “i” is 0, the OOB data has not been detected yet, so the flow returns to step 1502. If the flag “i” is 1, the OOB data has already been detected, and the flow proceeds to step 1503. .

  In the fourth embodiment, if search processing is performed by an automaton with backtracking, the backtrack stack is shared without using a buffer provided with temporary information separately when the search character string offset is on the OOB data. The configuration of the storage area and the process for accessing it are simplified.

The block diagram of the character string search apparatus in the 1st Embodiment of this invention. The flowchart of the automaton process request part of 1st Embodiment. The flowchart of the automaton process part of 1st Embodiment. The figure explaining the operation example of 1st Embodiment. The block diagram of the character string search apparatus in the 2nd Embodiment of this invention. The flowchart of the automaton process request part of 2nd Embodiment. The flowchart of the 1st automaton process part of 2nd Embodiment. The flowchart of the 2nd automaton process part of 2nd Embodiment. The block diagram of the character string search apparatus in the 3rd Embodiment of this invention. The flowchart of the automaton process request part of 3rd Embodiment. The flowchart of the automaton process part of 3rd Embodiment. The figure explaining the operation example of 3rd Embodiment. The block diagram of the character string search apparatus in the 4th Embodiment of this invention. The flowchart of the automaton process request part of 4th Embodiment. The flowchart of the automaton process part of 4th Embodiment. The figure explaining the operation example of 4th Embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 Input TCP text 100 Control part 102,502,902,1302 Automaton process request part 103,503,903,1303 Automaton process part 104 Automaton state transition part 105 Data buffer 106 Pattern matching result output part 901 Search mode selection part 1301 Backtrack Stack AT Automaton EX1 Character string example EX2 Character string example AT2 NFA automaton EX3 NFA character string example

Claims (13)

A state transition unit and a control unit;
The state transition unit stores text pattern characters and their transition states. When an input character is supplied from the outside, the text pattern is searched. The input character and the searched character are collated with each other as a search result. If there is a match, a determination output for the next transition instruction is generated.
The control unit receives TCP text including TCP OOB data, sequentially shifts the character search point from the start point to the end point on the received text, and supplies the character on the search point to the state transition unit. When the position of the OOB data is searched and, as a result, the determination output of the next transition instruction is obtained from the state transition unit, the search point is shifted in the direction of the end point by one character, and the state transition unit is detected before the OOB data is detected. When the determination output indicating that the transition is not possible is obtained, a collation failure output is generated, and when the OOB data is detected, the next character of the OOB data is supplied to the state transition unit as a search character. If the character at the position of the OOB data is supplied to the state transition unit as the search character to the state transition unit, and the determination output of the state transition unit cannot transition after detection of the OOB data, a verification failure occurs String search apparatus characterized by generating a verification success output when generating and displaying the end point. In Claim 1, if the said control part detects the position of the said OOB data, it will preserve | save the present position information of the said search point in a temporary memory part,
When the search point is shifted to a position obtained by adding 1 to the current position and a transition impossible display output is obtained from the state transition unit after the OOB data is detected, the search point is moved to the position indicated by the position information stored in the temporary storage unit. A character string search device characterized by being transferred. A state transition unit and a control unit;
The state transition unit stores each character of the text pattern and its transition state, searches for the text pattern when an input character is supplied from the outside, and collates the input character with the retrieved character as a search result. If there is a match, a determination output of the next transition instruction is generated. If they do not match, a determination output indicating that the transition is impossible is generated.
The control unit receives TCP text including TCP OOB data, sequentially shifts the character search point from the start point to the end point on the received text, and supplies the character on the search point to the state transition unit. When the position of the OOB data is searched and, as a result, the determination output of the next transition instruction is obtained from the state transition unit, the search point is shifted in the direction of the end point by one character, and the state transition unit is detected before the OOB data is detected. When a determination output indicating that a transition is impossible is obtained, a collation failure output is generated, and when the determination output of the state transition unit is not transitionable at the time of detection of the OOB data, a position shifted from the search point toward the end point by one character Is supplied to the state transition unit as a search character, and after the OOB data is detected, if the determination output of the state transition unit is not transitionable, a collation failure output is generated and the end point is displayed. String search device and generates a success output. An operation mode setting unit for setting mode 0 or mode 1, a state transition unit, and a control unit;
The state transition unit stores each character of the text pattern and its transition state, searches for the text pattern when an input character is supplied from the outside, and collates the input character with the retrieved character as a search result. If there is a match, a determination output of the next transition instruction is generated. If they do not match, a determination output indicating that the transition is impossible is generated.
The control unit receives TCP text including TCP OOB data, sequentially shifts the character search point from the start point to the end point on the received text, and supplies the character on the search point to the state transition unit. When the position of the OOB data is searched and, as a result, the determination output of the next transition instruction is obtained from the state transition unit, the search point is shifted in the direction of the end point by one character, and the state transition unit is detected before the OOB data is detected. When a judgment output indicating that transition is impossible is obtained from, a collation failure output is generated,
When the control unit is in mode 0, when the OOB data is detected, the control unit supplies the next character of the OOB data as a search character to the state transition unit, and when the determination output cannot be changed, the state transition unit receives the OOB data. The character at the position is supplied as a search character to the state transition unit, and when the OOB data is detected at the time of the mode 1 in the mode 1, if the judgment output of the state transition unit is not transitionable, the search point is terminated by one character. Supply the character at the position moved in the point direction to the state transition unit as a search character,
A character string search device that generates a collation failure output when the determination output of the state transition unit is not transitionable after detection of the OOB data, and generates a collation success output when the end point is displayed.   5. The character position information stored in claim 1, 2, 3, or 4 when character position information is stored in a storage unit at the time of detection of the OOB data, and the determination output of the state transition unit is not transitionable. , And supplies the character of the character position information to the state transition unit as a search character.   6. The character string search device according to claim 5, wherein the storage unit is a backtrack stack. A state transition unit, a storage unit, an automaton processing request unit, and an automaton processing unit;
The state transition unit stores each character of the text pattern and its transition state, searches for the text pattern when an input character is supplied from the outside, and collates the input character with the retrieved character as a search result. If there is a match, a next transition instruction output is generated. If they do not match, a transition impossible display output is generated.
The automaton processing request unit receives input data composed of TCP text including TCP OOB data, acquires position information of the OOB data from the input data, initializes an input value of the automaton processing unit,
The automaton processing unit detects a match or mismatch between a current search character string offset and the OOB data position, and when the match is detected, stores the search character string offset and a transition state in the storage unit, and performs the search. 1 is added to the character string offset, and the added search character string offset and the transition state are supplied to the state transition unit,
When the mismatch is detected, the current search character string offset and the transition state are supplied to the state transition unit, the output is determined, and if the transition is not possible, the automaton processing request unit is searched for the storage unit, and the search character string offset If the transition state is stored, the input value is reinitialized with the stored information, and if the search string offset and the transition state are not stored in the storage unit, a collation failure output is generated. Character string search device.   The character string search device according to claim 7, wherein the storage unit is a backtrack stack. A state transition unit, an automaton processing request unit, a first automaton processing unit, and a second automaton processing unit;
The state transition unit stores each character of the text pattern and its transition state, searches for the text pattern when an input character is supplied from the outside, and collates the input character with the retrieved character as a search result. If there is a match, a next transition instruction output is generated. If they do not match, a transition impossible display output is generated.
The automaton processing request unit receives input data composed of TCP text including TCP OOB data, acquires position information of the OOB data from the input data, initializes an input value of the automaton processing unit,
The first automaton processing unit detects a match or mismatch between the current search character string offset and the OOB data position, and when the match is detected, activates the second automaton processing unit to change the current search character string offset and transition The state is supplied as an argument to the second automaton processing unit, and when a mismatch is detected, the current search string offset and the transition state are supplied to the state transition unit,
The second automaton processor is
When activated by the first automaton processing unit, 1 is added to the search character string offset, and the added search character string offset and the transition state are supplied to the state transition unit, and the mismatch is detected. Character string search characterized in that the current search character string offset and transition state are supplied to the state transition unit, the output is determined, and if the output is not transitionable, the search is re-initialized based on the argument. apparatus. Each character of the text pattern and its transition state are stored, and when the input character is supplied from the outside, the text pattern is searched, and the input character and the searched character are compared with each other as a search result. In a system including a state transition unit that generates a transition instruction output and generates a transition impossible display output if they do not match,
a) Receive TCP text containing TCP OOB data,
b) Searching the OOB data while sequentially shifting the character search point on the received text from the start point to the end point;
c) Supply the character at the search point as a search character to the state transition unit to determine the output of the state transition unit. If the determination result is a next transition instruction, the next character is used as the search character to the state transition unit. Supply
d) Before the detection of the OOB data, if the determination result of (c) is a non-transitionable display, a collation failure output is generated,
e) When the OOB data is detected, the next character of the OOB data is used as a search character and the process returns to (c). Return to (c) as a character,
f) After detecting the OOB data, a character string search method characterized by generating a collation failure output when the determination result of (c) is non-transitionable display and generating a collation success output when displaying the end point. . Each character of the text pattern and its transition state are stored, and when the input character is supplied from the outside, the text pattern is searched, and the input character and the searched character are compared with each other as a search result. In a system including a state transition unit that generates a transition instruction output and generates a transition impossible display output if they do not match,
a) Receive TCP text containing TCP OOB data,
b) Searching the OOB data while sequentially shifting the character search point on the received text from the start point to the end point;
c) Supply the character at the search point as a search character to the state transition unit to determine the output of the state transition unit. If the determination result is a next transition instruction, the next character is used as the search character to the state transition unit. Supply
d) Before the detection of the OOB data, if the determination result of (c) is a non-transitionable display, a collation failure output is generated,
e) When the determination result of (c) is not transitionable at the time of detection of the OOB data, the character at the position shifted from the search point toward the end point by one character is returned as the search character to (c),
f) A character string search method, wherein after the detection of the OOB data, a collation failure output is generated when the determination result of (c) is not transitionable, and a collation success output is generated when the end point is displayed. Each character of the text pattern and its transition state are stored, and when the input character is supplied from the outside, the text pattern is searched, and the input character and the searched character are compared with each other as a search result. In a system including a state transition unit that generates a transition instruction output and generates a transition impossible display output if they do not match,
a) Set the operation mode to 0 or 1,
b) Receive TCP text containing TCP OOB data,
c) searching the OOB data while sequentially shifting the character search point from the start point to the end point on the received text;
d) Supply the character at the search point as a search character to the state transition unit to determine the output of the state transition unit, and if the determination result is a next transition instruction, the next character is used as the search character to the state transition unit. Supply
e) Before the detection of the OOB data, if the determination result of (c) is a transition impossible display, a collation failure output is generated,
f) When the operation mode is set to 0, when the OOB data is detected, the next character of the OOB data is used as a search character and the process returns to the step (c), and the state transition portion is displayed when the determination result is non-transitional display. The character at the position of the OOB data is used as a search character to return to (c),
g) When the operation mode is set to 1, if the determination result of (d) at the time of detection of the OOB data is a non-transitionable display output, the position shifted from the search point toward the end point by one character Return to (d) as a search character,
h) Regardless of the operation mode, after the OOB data is detected, if the determination result of (d) is (1) non-transition display, the character at the position of the OOB data is used as the search character in the state transition part (d) ), The character string search method is characterized in that (2) a collation failure output is generated when transition is not possible, and (3) a collation success output is generated when the end point is displayed.   A program for carrying out the character search method according to any one of claims 10 to 12.

Images