KR100832539B1 - Method and module for searching multi-pattern using pattern board which does not support multi-pattern - Google Patents

Abstract

A multi-pattern search method using a pattern board which doesn't support a multi-pattern and an apparatus for the same are provided to implement multi-pattern searching through a pattern board supporting only single-pattern searching by configuring a bitmap table for search rules and creating a pattern index table containing the input pattern information of each pattern board. A multi-pattern search apparatus comprises a search rule setup part(410), an information storage part(420), and a multi-pattern judgement part(430). The search rule setup part creates a bitmap table, which contains rule indexes, pattern information, and bitmap information, and a pattern index table, which contains the input pattern and pattern index information of each pattern board corresponding to each of the patterns of the bitmap table. The information storage part stores the bitmap table and the pattern index table. Using the pattern boards, the multi-pattern judgement part extracts one or more patterns from an input stream, confirms a search rule associated with the extracted patterns through the pattern index table, and judges the existence of a multi-pattern in the input stream through the bitmap table.

Description

Method and module for searching multi-pattern using pattern board which does not support multi-pattern}

1 is a flowchart of a multi-pattern search method using a pattern board according to an embodiment of the present invention;

2 is a diagram illustrating a bitmap table according to an embodiment of the present invention;

3 illustrates a pattern index table according to an embodiment of the present invention; and

4 is a block diagram showing a multi-pattern search apparatus using a pattern board according to an embodiment of the present invention.

The present invention relates to a pattern retrieval method and apparatus, and more particularly, to a multi-pattern retrieval method and apparatus for retrieving the presence or absence of two or more multi-patterns using a pattern board that does not support retrieval of multiple patterns for an input stream. .

In general, the pattern board is an acceleration board that searches whether a pattern to be found from an input stream is included and is used to perform a fast pattern search in a firewall or intrusion detection system.

However, the existing pattern board can only repeat the search of a single pattern when searching for a pattern on the input stream, and there is a problem in that a system using a rule including multiple patterns has usage restrictions.

An object of the present invention is to provide a multi-pattern retrieval method and apparatus for retrieving whether an input stream includes a multi-pattern using a pattern board designed to support a single pattern retrieval.

In order to achieve the above object, a multi-pattern retrieval method using a pattern board that does not support the multi-pattern of the present invention, the first step of generating a bitmap table for managing information about the multi-pattern included in the search rule; Generating a pattern index table defining a relationship with each search rule of the bitmap table for each input pattern of a pattern board; Extracting one or more patterns present in the input stream using the pattern board; And a fourth step of checking a search rule related to the extracted pattern by referring to the pattern index table and determining whether multiple search patterns exist in each search rule by referring to the bitmap table.

In order to achieve the above object, a multi-pattern retrieval apparatus using a pattern board that does not support the multi-pattern of the present invention includes a bitmap table and a bitmap table each including information about a pattern included in the search rule. A search rule setting unit generating a pattern index table including an input pattern of the pattern board and pattern index information corresponding to a pattern of the pattern board; An information storage unit for storing the bitmap table and the pattern index table; And extracting one or more patterns existing in the input stream using the pattern board, checking the rules including the extracted patterns by referring to the pattern index table and the bitmap table, and extracting the multiple patterns existing in the input stream. It includes a multi-pattern determination unit for searching.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, in describing in detail the operating principle of the preferred embodiment of the present invention, if it is determined that the detailed description of the related known functions or configurations may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. In addition, the same reference numerals are used for parts having similar functions and functions throughout the drawings.

1 is a view schematically showing the flow of a method for searching for multiple patterns according to an embodiment of the present invention. Referring to FIG. 1, an index of the rule, one or more patterns included in a rule corresponding to each rule index, and a pattern included in a single rule corresponding to each rule index according to a multi-pattern search rule A bitmap table is generated to manage the multi-pattern information included in the search rule, including the pattern bitmap information having the same number of bits as the maximum number of times (S100). The search rule is a predefined rule for intrusion detection in a firewall or intrusion detection system, and an actual implementation of the bitmap table will be described with reference to FIG. 2.

2 is a diagram illustrating a schematic view of a bitmap table according to an embodiment of the present invention. The bitmap table is a table including bitmap information of multiple patterns for each rule according to the multi-pattern search rule of the system for searching using the present invention. Referring to FIG. 2, in the present embodiment, the bitmap table includes a rule index 210, a pattern 220, and a pattern bitmap 230.

The rule index 210 is, for example, an index of a rule provided in an intrusion detection system or the like which searches for multiple patterns using the present invention. The pattern 220 represents one or more pattern information included in the search rule.

The pattern bitmap 230 includes information on multiple patterns included in each rule and is generated by using location information of each of the patterns 220 included in the search rule. In this table, the maximum number of bits of the pattern bitmap 230 is equal to the maximum number of patterns in a single rule. For example, when the maximum number of patterns in a single rule is 10, the bitmap table has pattern bitmap 230 information including 10 bits corresponding to each rule index 210. The number of bits of the pattern bitmap 230 may be equal to or greater than the maximum number of patterns in a single rule, but it is preferable to express the minimum number of bits.

Referring to step S100 in detail, first, a rule index 210 is set for each rule, a pattern 220 included in the rule index is determined, and a pattern bitmap for the patterns 220 is provided. The information is generated to construct a bitmap table. At this time, the pattern bitmap 230 is generated by setting the bit corresponding to the position information of the patterns within each rule to '1' and setting the rest to '0'. For example, referring to the row 240 in which the rule index 210 is 5 in the table of FIG. 2, three patterns of 'root', 'tree', and 'branch' are searched for in the rule. When these three patterns 220 are described in the bitmap table, the first bit of the pattern bitmap 230 corresponding to 'root' which is the first pattern of the pattern 220 item in the row 240 is' Set to 1 '(of course, it is possible to change the values of' 1 'and' 0 'or set them in different ways). Here, '(b)' located to the right of the first bit means binary number (hereinafter, binary will be referred to as '(b)'). Similarly, the second and third bits of the pattern bitmap 230 corresponding to 'tree' and 'branch' are set to '1', respectively. In this case, if the maximum number of patterns in a single rule is 10, the final pattern bitmap 230 of the rule having the rule index 210 of 5 has a value of 0000000111 (b).

Referring back to FIG. 1, after generating a bitmap table for a search rule (S100), a bit index indicating a position of each pattern in the pattern bitmap 230 of the bitmap table is calculated (S110). . For example, when n is a natural number, when the bit representing the pattern is the nth bit, the bit index may be calculated in a manner of representing the bit index of the pattern as n. That is, referring to the fifth row 240 of the bitmap table of FIG. 2 described above, since the bit of the pattern index 230 indicating 'root' of the pattern 220 is the first bit, the corresponding bit index is 1; Similarly, the bit indices corresponding to 'tree' and 'branch' are 2 and 3, respectively.

Referring back to FIG. 1, after calculating a bit index for each pattern on a bitmap table (S110), the rule index of the bitmap table, the maximum number information of patterns in a single rule, and the calculated bit index information are calculated. In operation S120, a pattern index is generated for all patterns included in the bitmap table. In operation S130, a pattern index table including pattern information and pattern index information corresponding thereto is generated. The generation of the pattern index and the pattern index will be described in more detail with reference to FIG. 3.

3 is a view schematically showing a pattern index table according to an embodiment of the present invention. In the present exemplary embodiment, the pattern index table includes input pattern 310 and pattern index 320 information corresponding to each pattern of the bitmap table. The input pattern 310 is a pattern used for searching using a pattern board. The input pattern 310 contains information about each pattern 220 of the bitmap table. The pattern index 320 is generated from the rule index 210 of the search rule including the pattern and the index of the bitmap 230 of the pattern. In this case, the generated pattern index is then output as a result value indicating the extracted pattern when a pattern of an input stream matching the input pattern 310 of the pattern board is searched.

When each pattern is input to the pattern index table, an index to be used as a pattern search result for the input stream is required. The pattern index 320 includes the rule index 210 of the pattern and the bitmap 230 of the pattern. Using the maximum number of indexes and patterns in a single rule, create the following equation.

PI = (RI-1) x MP + BI

In the above formula, PI is the pattern index,

RI is the rule index,

MP is the maximum number of patterns within a single rule, and

BI bit index.

For example, when the maximum number MP of patterns in a single rule is 10, the pattern index 320 for the pattern 'tree' of the row 240 of FIG. 2 has a rule index RI of 5 and a bit index. Since (BI) is 2, it becomes 42 by the said formula.

PI = (5-1) x 10 + 2 = 42

By repeating this process, a pattern index 320 is generated for all patterns 220 of the bitmap table, and each of the patterns 220 is an input pattern 310 and a pattern including corresponding pattern index 320 information. You can create index tables.

Referring back to FIG. 1, after generating the pattern index table (S130), and when an input stream is received (S140), a pattern matching the input pattern 310 of the pattern board is extracted, and from the pattern index table. The pattern index 320 is searched for (S150). The rule index and the bit index of the extracted pattern are calculated using the pattern index 320 retrieved in the step S150 and the maximum number of patterns in the single rule (S160). In this case, the rule index may be calculated through, for example, the following equation.

RI = (PI / MP) + 1

In the above formula, RI is a rule index,

'/' Is an operator representing the quotient of the left variable divided by the right variable,

PI is the pattern index, and

MP is the maximum number of patterns within a single rule.

In addition, the bit index may be calculated through, for example, the following equation.

BI = PI% MP

In the above formula, BI is a bit index

'%' Is an operator representing the remainder of the left variable divided by the right variable,

PI is the pattern index, and

MP is the maximum number of patterns within a single rule.

For example, when the search result pattern index (PI) 320 is 42, the rule index RI and the bit index BI are 5 and 2, respectively.

RI = (42/10) + 1 = 5

BI = 42% 10 = 2

That is, the search result 42 of the pattern index 320 means that the input stream includes “tree”, which is the second pattern 220 of the rule having the rule index 210 of 5 on the bitmap table.

Thereafter, the flag variable of each pattern included in the input stream is generated using the calculated information (S170). The flag variable has a number of bits equal to the maximum number of patterns in a single rule of the bitmap table. The bit at the position indicated by the bit index calculated for the pattern is set to '1' and the remaining bit values are set to '0' (in this case, the values of '1' and '0' are interchanged). Of course, you can set or otherwise).

For example, the flag variable is generated using the following equation.

Flag [RI] = Flag [RI] OR {1 << (BI-1)}

In the above formula, RI is a rule index,

BI is a bit index, and

'<<' is a bit shift left operator.

For example, if the maximum number of multiple patterns in a single rule is 10 and the calculation result for a specific pattern extracted from the stream has a rule index of 5 and a bit index of 2, then the corresponding flag variable Flag [RI] is 1 << (2- 1) (i.e., shifting the bit of '1' to the left by 1), the second bit is set to '1' as shown below.

Flag [5] = 0000000010 (b)

After generation of the flag variable for a specific pattern (S170), the steps (S150 to S170) are repeated for another pattern of the stream. If there is no input stream to be searched further (S180), the rule index calculated in step S160 among the patterns extracted from the stream is compared and the final flag variable is generated by combining the flag variables of the pattern having the same pattern (S180). S190).

The combination of each flag variable compares the bit value of the same position in each flag variable and sets the bit value of the same position of the last flag variable to '0' only when the corresponding bit values are all '0', The remaining bit values are set in a manner of '1' (as described above, other methods may be possible). For example, if the pattern of 'root' and 'tree' is extracted from the stream, each flag variable is set as above Flag [5] = 0000000001 (b), Flag [5] = 0000000010 (b) Will be generated as Since the bit values of both flag variables are '0' from the third bit to the tenth bit, the bit value is '0' from the third bit to the tenth bit of the last flag variable, and the bit value of the first and second bit is not. Becomes '1'. Therefore, the final flag variable value of the patterns having the rule index of 5 among the patterns included in the stream becomes Flag [5] = 0000000011 (b).

When the final flag variable is generated in this manner (S190), this value is compared with the information in the bitmap table (S200). That is, if the last flag variable is Flag [5] (meaning the rule index is 5), the corresponding final flag value is compared with the corresponding pattern bitmap value in the row with the rule index of the bitmap table of 5, and if it matches, Multiple patterns of that rule will have matching search results for the input stream.

For example, in the final stage of a pattern search where the maximum number of patterns in a single rule is 10, the value of the last flag variable with rule index 210 of 5 is Flag [5] = 0000000011 (b) and rule index of 5 If the pattern bitmap 230 of the rule is 0000000111 (b), the corresponding multipattern 230 finally determines that there is no match for the input stream. In other words, the result of the multi-pattern check on 'root', 'tree', and 'branch' of row 240 with index 5 actually matches only the patterns of 'root' and 'tree' in the input stream. It can be seen that multiple patterns do not exist.

4 is a diagram schematically showing the configuration of a multi-pattern search apparatus 400 according to an embodiment of the present invention. Referring to FIG. 4, the multi-pattern search apparatus according to the present embodiment includes a search rule setting unit 410, an information storage unit 420, and a multi-pattern determination unit 430.

The search rule setting unit 410 sets information on multiple patterns included in a rule to be searched, that is, a bitmap table and a pattern index table using the present invention. The setting may be made by a system administrator, and may be appropriately set as necessary in a system using the present invention.

The information storage unit 420 may include a bitmap table including information about a pattern included in a multi-pattern search rule set by the search rule setting unit 410, and a pattern board corresponding to each of the patterns of the bitmap table. A pattern index table including an input pattern and pattern index information of 440 is stored. The bitmap table may include an index of the rule, one or more patterns included in a rule corresponding to each rule index, and a maximum number of patterns included in a single rule corresponding to each rule index according to a multi-pattern search rule. Contains pattern bitmap information consisting of the same number of bits.

The multi-pattern determination unit 430 extracts a pattern included in a search rule with respect to the input stream using the pattern board 440, and searches the pattern index table to extract a corresponding pattern index. A flag variable is generated by calculating a rule index and a bit index of the corresponding pattern, and a final flag variable is generated by classifying extracted patterns having the same rule index. Finally, the final flag variable corresponding to each rule index used in the classification and the pattern bitmap of the bitmap table are compared to search for multiple patterns. The details of the bitmap table, the pattern index table, and the multi-pattern search process have been described with reference to FIGS. 1, 2, and 3.

So far I looked at the center of the preferred embodiment of the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

In the multi-pattern retrieval method using a pattern board that does not support the multi-pattern of the present invention as described above, by constructing a bitmap table for a search rule and generating a pattern index table including input pattern information of the pattern board, Allows to search for multiple patterns using pattern boards that do not support patterns.

Multi-pattern retrieval apparatus using a pattern board that does not support the multi-pattern of the present invention as described above, by using a pattern board that supports the search of a single pattern of the multi-pattern that can be easily expanded without requiring additional hardware Present a search device.

Claims (22)

Generating a bitmap table that manages rule indexes, pattern information, and pattern bitmap information, which are information on multiple patterns included in a search rule; Generating a pattern index table defining a relationship with each search rule of the bitmap table for each input pattern of a pattern board; Extracting one or more patterns present in the input stream using the pattern board; A pattern that does not support multiple patterns including a fourth step of identifying a search rule related to the extracted pattern by referring to the pattern index table and determining whether multiple search patterns exist in each search rule by referring to the bitmap table Multi-pattern search method using board. The method of claim 1, The rule index indicates an index of a search rule, the pattern information indicates one or more pattern information included in each rule, and the pattern bitmap information includes the same number of bits as the maximum number of patterns in a single rule. The multi-pattern search method using a pattern board that does not support multiple patterns, characterized in that generated by the location information of the patterns. The method of claim 2, wherein the pattern bitmap is A multi-pattern retrieval method using a pattern board that does not support multiple patterns, characterized in that it is a pattern bitmap in which the bit value corresponding to each position of the pattern is set to 1 and the remaining bit values are set to 0. The method of claim 2, wherein the first step And calculating a bit index indicating a position of each pattern in the pattern bitmap of the bitmap table. The method of claim 4, wherein the bit index is When n is a natural number, if the bit representing the pattern is the nth bit, the multi-pattern retrieval method using a pattern board that does not support multiple patterns, characterized in that the corresponding bit index is calculated as n. The method of claim 4, wherein the pattern index of the second step is The multi-pattern retrieval method using a pattern board that does not support multiple patterns, characterized in that generated using the rule index of the bitmap table, the maximum number of patterns in a single rule and the bit index information. The method of claim 6, wherein the pattern index is Multiple pattern retrieval method using a pattern board that does not support multiple patterns, characterized in that generated using the following formula. PI = (RI-1) x MP + BI In the above formula, PI is the pattern index, RI is the rule index, MP is the maximum number of patterns within a single rule, and BI bit index. The method of claim 6, wherein the fourth step Retrieving a pattern index corresponding to each of the extracted patterns from the pattern index table; And Computing a rule index and a bit index of the extracted pattern using the retrieved pattern index and the maximum number of patterns in the single rule using a pattern board that does not support multiple patterns Multi-pattern search method. The method of claim 8, wherein the rule index of the extracted pattern is Multiple pattern search method using a pattern board that does not support multiple patterns, characterized in that calculated using the following formula. RI = (PI / MP) + 1 In the above formula, RI is a rule index, '/' Is an operator representing the quotient of the left variable divided by the right variable, PI is the pattern index, and MP is the maximum number of patterns within a single rule. The method of claim 8, wherein the bit index of the extracted pattern is Multiple pattern search method using a pattern board that does not support multiple patterns, characterized in that calculated using the following formula. BI = PI% MP In the above formula, BI is a bit index '%' Is an operator representing the remainder of the left variable divided by the right variable, PI is the pattern index, and MP is the maximum number of patterns within a single rule. The method of claim 8, wherein the fourth step Generating a flag variable of each of the extracted patterns by using the rule index and bit index information calculated for the extracted patterns; multi-pattern search using a pattern board not supporting multiple patterns Way. The method of claim 11, wherein the flag variable is A multi-pattern search method using a pattern board that does not support multiple patterns, characterized in that the bit value of the position indicated by the corresponding bit index is set to 1 and the remaining bit values are set to 0. The method of claim 11, wherein the fourth step Classifying a pattern having the same rule index among the patterns extracted from the input stream and combining the calculated corresponding flag variables to generate a final flag variable for the classified pattern. Multi-pattern search method using pattern board not supported. The method of claim 13, wherein the last flag variable is It is created by comparing bit values of the same position in each flag variable and setting the same position bit value of the last flag variable to 0 and setting the remaining bit values to 1 only when the corresponding bit values are all 0. Multiple pattern search method using a pattern board that does not support multiple patterns, characterized in that. The method of claim 13, wherein the fourth step Comparing the generated final flag variable and the pattern bitmap information of the bitmap table corresponding to the rule index, if the match is matched, it is determined that the multiple pattern of the rule exists in the input stream Multi-pattern search method using unsupported pattern board. A bitmap table including rule index, pattern information, and pattern bitmap information, which are information on patterns included in a search rule, and input patterns and pattern index information of a pattern board corresponding to each pattern of the bitmap table. A search rule setting unit for generating a pattern index table; An information storage unit for storing the bitmap table and the pattern index table; And Extract one or more patterns existing in the input stream using the pattern board, check the rules including the extracted patterns by referring to the pattern index table and the bitmap table, and search for the multi-patterns present in the input stream. Multi-pattern retrieval apparatus using a pattern board that does not support multiple patterns including a multi-pattern determination unit. The method of claim 16, wherein the bitmap table The rule index indicates an index of a search rule, the pattern information indicates one or more pattern information included in each rule, and the pattern bitmap information includes the same number of bits as the maximum number of patterns in a single rule. Multiple pattern retrieval apparatus using a pattern board that does not support multiple patterns, characterized in that generated by the location information of the patterns. The method of claim 17, wherein the multi-pattern determination unit Multi-pattern retrieval apparatus using a pattern board that does not support multiple patterns, characterized in that for calculating the bit index indicating the position of each pattern in the pattern bitmap of the bitmap table. The method of claim 18, wherein the pattern index is Multi-pattern retrieval apparatus using a pattern board that does not support multiple patterns, characterized in that by using the following formula. PI = (RI-1) x MP + BI In the above formula, PI is the pattern index, RI is the rule index, MP is the maximum number of patterns within a single rule, and BI bit index. 19. The apparatus of claim 18, wherein the multi-pattern determination unit Search for a pattern index corresponding to each of the extracted patterns in the pattern index table and search for a multi-pattern using a pattern board that does not support multiple patterns, wherein the rule index of the extracted pattern is calculated using the following equation. Device. RI = (PI / MP) + 1 In the above formula, RI is a rule index, '/' Is an operator representing the quotient of the left variable divided by the right variable, PI is the pattern index, and MP is the maximum number of patterns within a single rule. The method of claim 20, wherein the multi-pattern determination unit Multi-pattern retrieval apparatus using a pattern board that does not support multiple patterns, characterized in that to calculate the bit index of the extracted pattern using the following formula. BI = PI% MP In the above formula, BI is a bit index '%' Is an operator representing the remainder of the left variable divided by the right variable, PI is the pattern index, and MP is the maximum number of patterns within a single rule. The method of claim 21, wherein the multi-pattern determination unit The flag variable of each of the extracted patterns is generated using the rule index and the bit index information calculated for the extracted pattern, and the calculated rule index is classified among the patterns extracted from the input stream and the same pattern is calculated. Multi-pattern retrieval apparatus using a pattern board that does not support multiple patterns, characterized in that to generate a final flag variable for the classified pattern by combining the corresponding flag variables.

Images