KR102014741B1 - Matching method of high speed snort rule and yara rule based on fpga - Google Patents

Abstract

The present invention relates to an FPGA-based fast snort rule and Yarra rule matching method, comprising: a rule conversion step of converting a snort rule and a yarra rule in a detection rule converter to store a fixed pattern and a PCRE pattern in a memory on a hardware board; A pattern matching step of receiving a packet input from a network based on the converted rule, parsing the packet in a packet FIFO and a fast packet processing module, and performing fixed pattern and PCRE pattern matching, respectively; Receives the header value and payload of the packet from the packet parsing, reconstructs the file, stores it in a memory inside the FPGA, and matches the stored hash values based on the additionally input packet to match the mitigation control signal in the detection result processing module. A hash matching step occurring; And a packet forwarding step of successively generating packet drop and packet forwarding by determining whether to relax the packet by reading the packet from the packet FIFO.

Description

MATCHING METHOD OF HIGH SPEED SNORT RULE AND YARA RULE BASED ON FPGA

The present invention relates to an FPGA-based fast snort rule and a YARA rule matching method.

Many companies and individuals use computers to access the network to share information. In addition, these network users typically use the Internet through Web sites for many purposes to share minimal information between computers and computers outside the network. This sharing of information is accomplished by establishing a communication session between the server computer and the client computer. Physical and logical connections between these computers create a global computer network such as the Internet.

Unfortunately, malicious computer users can use the Internet connection to interfere with network communications over the Internet, to access confidential data, or to erase data. An example of such an attack is a denial of service ("DoS") attack in which an attacker attempts to deny service to a particular client of a victimized computer.

DoS attacks can be performed in a variety of ways, including using the server's memory and network connections. Server computer services may be interrupted by network attacks that can be detected by IDS or IPS systems.

To establish a network connection, you need to establish a session between the client computer and the server. For example, a client computer requests a service from a server. In response to this request, the server allocates memory space and processing time, sends the response back to the computer, and waits for the client computer to respond. The client computer can send many service requests to the server but may not reply back to the server. The server then waits for a response that it can never receive while wasting memory and processing time. While waiting, the server may run out of memory, process space, or lose network connectivity while receiving additional data packets. As a result, there are so many requests that the server cannot provide a connection to a legitimate user and the server's communication over the Internet is essentially terminated. This can cause loss of e-mail, internet access, and web server functionality.

Another example of such an attack would be to flood a server with a large amount of data packets to consume all the CPU power, running numerous programs or scripts on the server to prevent legitimate users from accessing the network or consuming available memory space. There is a case.

Of the many network attack types, it is difficult to detect attacks that use the signature of the packet payload when many packets need to be examined. The current processes for applying signature detection and post-detection detection policies are software-based solutions using pure CPU power. Based on the logical structure of S / W, CPU-based solutions have a lot of problems to improve performance because the functions to be basically processed are sequentially processed. Therefore, if the fixed link speed cannot be handled in a single network security system, the network structure becomes complicated and operation difficulties occur.

An object of the present invention for solving the above problems is to convert the rules applied in the snort and Yarra to detection rules to be used in the device and to always apply the rules after the start of the matching device to the highest speed for the inflow of packets input to the device. FPGA-based fast snort rule and Yarra rule matching that detects rules by packet, session, and file, and prevents the introduction of harmful packets and files through packet-based defense for real-time security of the network according to the detection and response method. To provide a way.

In addition, another object of the present invention is to implement a hardware-based parallel processing function capable of predicting performance using an FPGA, FPGA-based high-speed to overcome the detection and prevention performance degradation caused by a signature matching process that is complex network structure and consumes CPU power It is to provide a snort rule and Yarra rule matching method.

The FPGA-based fast snort rule and Yarra rule matching method of the present invention for achieving the above object is to convert the snort rule and Yarra rule in the detection rule converter to store the fixed pattern and PCRE pattern in the memory on the hardware board Rule conversion step; A pattern matching step of receiving a packet input from a network based on the converted rule, parsing the packet in a packet FIFO and a fast packet processing module, and performing fixed pattern and PCRE pattern matching, respectively; Receives the header value and payload of the packet from the packet parsing, reconstructs the file, stores it in a memory inside the FPGA, and matches the stored hash values based on the additionally input packet to match the mitigation control signal in the detection result processing module. A hash matching step occurring; And a packet forwarding step of successively generating packet drop and packet forwarding by determining whether to relax the packet by reading the packet from the packet FIFO.

The rule converting step may include: a snort rule and a yala rule editing step of converting the snort and yarra rules in a detection rule converter; A fixed pattern storage step of storing fixed patterns converted from the snow rules and the Yarra rules in an internal dual port RAM block memory of an FPGA in which a detection engine operates so that the fixed patterns converted from the snort rules and the Yarra rules can be applied; And a PCRE pattern storage step of storing the PCRE pattern in the result value converted from the snort and Yarra rules in a memory on the FPGA board.

The pattern matching step may include: a network packet receiving step of receiving an input packet, storing the packet in a packet FIFO, and simultaneously transferring the packet to a high speed packet processing module 200 for packet parsing and distinguishing between a header value and a payload; The content corresponding to the payload of the extracted result is a fixed pattern matching step of comparing in real time with a fixed pattern stored in the FPGA; A PCRE pattern matching request step of identifying whether there is a PCRE pattern applied to the corresponding rule when identifying the rule number assigned to each fixed pattern when a result of the fixed pattern matching detection is generated; And a PCRE pattern matching step of allowing the PCRE pattern matching to proceed by reading the relevant PCRE pattern from the PCRE pattern storage and programming the relevant DFA so that the PCRE pattern matching can be applied to the PCRE pattern matching. .

The hash matching step may include: a file reassociation step of receiving a header value and a payload of a packet from the packet parsing and reconstructing a file based on a corresponding session; A file based hash operation and updater for storing an MD5 hashing result of the reconstructed file in a memory inside the FPGA; A hash value matching step of calculating hash values of files reconstructed based on an additionally input packet and comparing the hash values with stored hash values; A PCRE pattern matching request step of determining whether or not to perform PCRE rule matching; And a detection result processing step of generating a mitigation control signal based on the detection results in the pattern matching step and the hash matching step, and delivering the mitigation control signal to the packet forwarding engine.

The packet forwarding step may include: a packet buffering step of receiving and buffering a packet input from a network; And a mitigation policy application step of determining whether to relax the packet by reading the packet from the packet FIFO so that a packet drop and a packet forwarding function are continuously generated.

As described above, according to the present invention, a snow rule and a Yarra rule detection engine may be implemented using an FPGA, which is a hardware device, and may be applied to inline mitigation by performing further processing using the detection result.

And. According to the present invention, the snow rules and the Yarra rules can be compiled into their own rule formats for FPGA-based pattern matching, PCRE rule matching, and Yarra rule matching, thereby optimizing the detection speed and the amount of application of the FPGA internal requirements.

In addition, according to the present invention, the detection result can be applied to a logic device on a hardware board and applied to an inline engine.

In addition, according to the present invention it is possible to implement a high-speed performance by applying a parallel signal processing method and a parallel function module in the FPGA.

In addition, according to the present invention, it is possible to improve the operation speed by applying to the dynamic detection whitelist entry through the session data preprocessing to increase the overall performance by reducing the startup of the internal operation module of the detection engine.

In addition, according to the present invention can be applied in the process of generating and detecting the real-time dynamic file detection result entry to distinguish the files downloaded from the same web server to go through the entire detection routine only once for the same file.

FIG. 1 is a block diagram of an FPGA-based fast snort rule and a YARA rule matching device according to the present invention.
2 is a detection rule converter output table applied to the snow rules and the Yarra rules according to the present invention.
3 is a block diagram of a detailed functional module of the high speed packet processing module according to the present invention.
4 is a block diagram of a detailed functional module of the signature matching module according to the present invention.
5 is a functional block diagram of a high-speed signature scanning module according to the present invention.
Figure 6 is a block diagram of the internal structure of a high-speed signature length scanning module according to the present invention.
7 is a block diagram of a PCRE detection module according to the present invention.
8 is a block diagram of a dynamic hash and match module according to the present invention.
9 is a flowchart of an FPGA-based fast snort rule and Yarra rule matching method according to the present invention.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention.

Next, a preferred embodiment of the FPGA-based fast snort rule and Yarra rule matching device of the present invention will be described in detail.

1 is a block diagram of an FPGA-based fast snort rule and Yarra rule matching device according to the present invention.

Referring to FIG. 1, the FPGA-based fast snort rule and Yarra rule matching device of the present invention may include a detection rule converter 100 and a detection engine (Detection Engine) for converting a snort rule and a yarra rule ( 1000).

SNORT is a detection and blocking tool used as an open source network-based intrusion detection system (NIDS) and a network-based intrusion prevention system (NIPS). It can perform real-time traffic analysis and packet logging on Internet traffic (IP) networks. have. Here, the snort performs protocol analysis, content searching, and matching, and snort uses a detection rule to implement such a function.

YARA is a tool used to identify and classify malicious software samples using easy-to-define rules. It is used to classify files using YARA or run processes to identify the types of malicious code. This tool allows you to perform signature-based detection of malware similar to what an antivirus solution can do for you.

The detection rule converter 100 converts the snort rule and the Yarra rule format to enable the fast packet processing module 200 and the PCRE detection module of the detection engine 1000. A regular expression detection module 300, and a detection result processing module 500.

The detection engine 1000 detects a fixed pattern in the fast packet processing module 200 by receiving an input packet input from a network based on the content of a rule provided from the detection rule converter 100, and the PCRE detection module. PCRE pattern matching at 300, and identical file search results performed at Dynamic Hash & Match Control Module 400, and high speed at Detection Result Processing Module 500. Based on the results of the packet processing module 200 and the PCRE detection module 300 and the dynamic hash and match control module 400, the policy to be applied when the detection result is positively determined is determined. When the mitigation control signal provided from the detection result processing module 500 is transmitted to the mitigation policy application module 700, the mitigation policy application module 700 sends a packet FIFO. The input packet stored in the 600 is read, the detection result application policy is applied, and then sent as an output packet.

When the input packet is stored in the packet FIFO 600 and the processing result of the detection engine 1000 for the packet is prepared in the mitigation policy applying module 700, it is read and applied to the output packet. .

Hereinafter, a description will be given with the flow of the input packet in the direction.

The detection rule converter 100 receives the snow rules and the Yarra rules, converts them into a rule format for the detection function, stores the result, and applies the detection rules to the detection engine 1000. When the PCRE pattern is requested to apply a new PCRE pattern on a packet basis from the detection engine 1000, the PCRE pattern is transmitted to the detection engine 1000 in real time and used in the PCRE detection module 300.

Input Packets are received from the network and stored in the packet FIFO 600.

The input packets are simultaneously supplied to the fast packet processing module 200 and the dynamic hash and match control module 400 at the moment they are written to the packet FIFO 600.

The high speed packet processing module 200 parses the packet to distinguish between the header value and the payload value, and detects a fixed pattern signature. In addition, the extracted header value and payload information are transmitted to the dynamic hash and match control module 400, the PCRE detection module 300, and the detection result processing module 500, and the fixed pattern detection result is detected. Forward to 500. The fixed patterns are supplied from the detection rule converter 100 and the new fixed pattern values are configured to update the new entry or to delete the existing entry in the detection rule converter 100.

Here, the fast packet processing module 200 is a module that detects a fixed pattern at high speed among detection parameters of the converted rule. The fixed pattern matching result signals may be used as a reference signal for activating the function of the PCRE detection module 300.

The PCRE detection module 300 continuously communicates with the detection rule converter 100 while the device is in operation. If the fixed pattern matching result is positive from the fast packet processing module 200 and there is a PCRE pattern applied to the rule number provided by the detection rule converter 100, the PCRE pattern is received so that the internal DFA can detect the PCRE pattern. Program. This is done on a packet basis.

Here, the PCRE detection module 300 is a module that detects the PCRE rule among the detection parameters of the converted rule. Based on the matching result of the high-speed packet processing module 200, the PCRE rule is loaded into PCRE detection sub-engines that are commonly used in real time to minimize the amount of internal required logic as a cost-effective condition. It can be used effectively to detect PCRE rules and to detect large amounts of PCRE rules.

Input packets are also input to the dynamic hash and match control module 400. The header value and the payload value for the same packet are supplied from the high speed packet processing module 200. Check the recombination of the files from the payload, combine the files, and extract their own parameters that can distinguish the types of data that may appear repeatedly in the input data (for example, files). Reduce the procedure for calculating hash values for the system to improve the overall performance of the system.

Here, the dynamic hash and match control module 400 accumulates file-related data from incoming packets (Incoming Packets) to recombine the file, and first extracts metadata of the file starting to be recombined. Determining whether to start the process of accumulating the file and generating a hash value by accumulating the entire packets, and comparing the hash value of the recombined file with the stored hash values.

Fixed pattern matching results, PCRE matching results, and hash matching results from the fast packet processing module 200, the PCRE detection module 300, the dynamic hash, and the match control module 400 are processed in packet units. The result values are comprehensively compared at the same time to generate a Mitigation Control signal based on the Rule Policies provided by the detection rule converter 100.

The mitigation policy application module 700 knows how to process an input packet stored in the packet FIFO 600 based on the mitigation control signal provided from the detection result processing module 500 and the packet from the packet FIFO 600. READ is used to mitigate related packets (packet drop or forwarding) and send them as output packets.

In this case, the detection result processing module 500 aggregates detection and matching results of the detection rule converter 100, the fast packet processing module 200, and the PCRE detection module 300 in real time to mitigate packet-by-packet mitigation. In order to protect against harmful traffic on a packet-based, session-based, or file level basis. Especially in the case of file-based attacks, it is possible to implement detection, blocking and additional mitigation without delaying the traffic flow by using a technique that blocks the last packet of harmful traffic (file), which requires the complete file combination. It provides a function that enables it. The ability to accumulate packets on a per session basis and to reassemble files is implemented using SDRAM (gigabyte size), which is integrated with the FPGA.

Here, the packet FIFO 600 adjusts the system delay so that the result signal (Mitigation Control) processed by the detection result processing module 500 is processed by the mitigation policy application module 700 and output as an output packet. Can be buffered.

2 is a detection rule converter output table applied to the snort rule and the Yarra rule according to the present invention, and the detection rules applied to the Snort rule and Yarra rule used to detect harmful patterns in IPS equipment or next-generation IPS. It shows an example of the results of the conversion to a form that can be applied to the detection engine-based harmful pattern detection module used in the invention.

The function module implemented by the present invention is a rule to be detected based on all parameters (Protocol, Source IP, Source Port, Direction, Destination IP, Destination Port, Fixed Pattern, PCRE) shown in the detection rule converter output table 110. Find me.

3 is a configuration diagram of the detailed functional module of the high speed packet processing module according to the present invention.

Referring to FIG. 3, the high speed packet processing module 200 detects a fixed pattern among detailed parameters of the snow rule and the Yarra rule.

The incoming traffic (the incoming packet, for example, Layer 2 Ethernet frame) is input to the signature matching module 210 and the packet parsing module 220.

The signature matching module 210 extracts header information of layer 2, layer 3, and layer 4 from all input packets and generates a reference signal for identifying the layer 7 data area.

The layer 3 and layer 4 header information may be applied to store basic data for extracting files capable of accumulating the contents of a packet or a file transmitted through a communication session or to classify the detected result.

Matching using fixed patterns of the detection rule converter output table 110 is started based on a signal indicating a starting point of the layer 7 data region. Fixed Pattern entries are compared with incoming packets that are read by a software program related to the present invention and programmed and entered into an internal matching logic.

The signature matching module 210 compares in real time with the payload of all incoming packets and the signature matching results along with the header information are passed to the Packet Handling Decision Module 230. As a result of the fast pattern determination result signal, the signal is transmitted to the PCRE detection module 300 and the detection result processing module 500.

4 is a configuration diagram of a detailed functional module of the signature matching module according to the present invention, and the detailed functional modules are as follows.

Referring to FIG. 4, the signature matching module 210 includes a fast signature scanning module 211, a scanned data storage module 212, and an exact pattern matching module. (213).

Signature matching is performed in units of bytes, and fixed patterns are compared with input packet data programmed and input to the fast signature scanning module 211 and the complete pattern matching module 213.

In the case of the high speed signature scanning module 211, a main objective of the fast signature scanning module 211 is to identify a region of data in which an actual high speed pattern may exist by comparing a length with a portion of a fixed pattern. This function is implemented by using dual-port RAM and stores information on some patterns of the fixed pattern and the length of the pattern, and specifically checks the area to be compared in the data of the input packet. The scanned data stream generated in this way is transferred to the Scanned Data Storage Module 212 so that the data corresponding to the identified length is completely matched by the pattern matching window signal length. It is stored in the internal memory of the (Exact Pattern Matching Module) 213.

The data stored in this way is compared in the complete pattern matching module 213 with the scan data stream input to the fast signature scanning module 211.

When the comparison result is positive, a positive signature matching result is generated.

When there is a PCRE parameter included in one rule together with the detected pattern, a specific PCRE rule is programmed into the PCRE detection module 300 to start PCRE related matching.

5 shows the detailed functions of the functional blocks of the fast signature scanning module according to the present invention.

In FIG. 5, a process of finding a signature to be matched with data of an input packet is described using the signature "/script/update.asp" as an example.

Hexadecimal text of ASCII text "/script/update.asp" is "2f 73 63 72 69 70 74 2f 75 70 64 61 74 65 2e 61 73 70".

The fast signature scanning module 211 stores the lengths of the patterns ".asp" and "/script/update.asp" while uploading "/script/update.asp" as a fixed pattern to be detected. . This information is stored in the fast signature length scanning module 217 and the fast signature pattern matching module 218. The fast signature length scanning module 217 checks the length of the signature and checks the high speed signature. The pattern matching module 218 actually compares some pattern regions of the signature.

The signatures for a plurality of fixed patterns are stored in the fast signature length scanning module 217 and the fast signature pattern matching module 218, respectively, with matched pattern length values and partial pattern matching results (partial). Pattern Matching Result) values are generated and passed to the signature window selection module 219. Then, the signature window selection module 219 generates a pattern matching window signal by determining a length and a comparison position of the fixed pattern for the fixed pattern that meets two conditions among the stored fixed patterns, thereby processing the search result with the PCRE search module 300. Supply to module 500.

Figure 6 illustrates the internal structure of the fast signature length scanning module according to the present invention.

Referring to FIG. 6, the fast signature length scanning module 217 is used to check the length of a pattern to be detected using a plurality of dual port RAM 220.

Information about a length of a fixed pattern uploaded through one address port and data ports of the dual port RAM 220 is stored. For example, in the case of "/script/update.asp", the duplex uses the hexadecimal texts of ".asp" corresponding to the values of the last four ASCII texts as addresses and the length of the failure pattern as data. WRITE to the port RAM 220.

When an incoming packet is applied to the address of the other port of the dual port RAM 220 updated as described above, the values read out indicate the length of the pattern including each input byte value. . In the present case, the value of the pattern length to be pattern matched is read out four times in the same length.

The fast signature pattern matching module 218 updates the memory area of the dual port RAM 220 by using the hexadecimal value of the remaining part of the pattern to be updated in the same manner.

In this case, writing a value of "1" using some bits of the bits used for each data indicates that a byte of an incoming packet applied to an address line is part of a pattern to be detected.

7 shows the structure of a PCRE detection module according to the present invention.

Referring to FIG. 7, the PCRE detection module 300 is composed of a plurality of PCRE detection submodules 310. The PCRE detection submodule 310 is composed of a multi-pattern detection module 320 and a programmable PCRE match module 330.

The multi-pattern detection module 320 receives fixed pattern matching results detected by the high speed packet processing module 200 and, in the case of a rule including a related fixed pattern, when the number of fixed patterns is multiple. After detecting the multi-patterns, the PCRE rule request signal is generated, and the PCRE rule included in the corresponding rule is written to the programmable PCRE match module 330 by the PCRE rule.

The main functions to be implemented in the present invention are possible through the PCRE detection function. In the case of the programmable PCRE match module 330, a small amount of the PCRE may be programmed in real time based on the result of the multi-pattern detection module 320. PCRE detection is implemented using logic.

The PCRE detection submodule 310 is implemented according to the result of the fixed pattern. When there is a possibility that the analysis result of the fixed pattern may be included in several rules, a plurality of PCRE detection submodules 310 are simultaneously driven to pay the packet. Allows PCRE matching for payloads to be handled in real time.

Each PCRE detection submodule 310 generates PCRE matching results, which are then passed to the detection result processing module 500.

8 shows a structure of a dynamic hash and match module according to the present invention.

Referring to FIG. 8, the main purpose of the dynamic hash and match module 400 is to extract its own parameters that can distinguish the types of data (eg, files) that may appear repeatedly in the input data, and repeatedly to the same file. By increasing the overall performance of the system by reducing the procedure for calculating the hash value for.

The dynamic hash and match module 400 may include a file content hashing module 410, a hash match module 420, a metadata extraction module 430, and a metadata match module 440. And a metadata entry table 450.

The file content hashing module 410 grasps the starting point of the file delivered through session information consisting of input packets, collects packets belonging to the related file, and restores the file without the interworking function with the CPU in the device of the present invention. . A hash result is generated by running a hash function (eg MD5 hash) to check whether there is a harmful pattern included in the restored file.

The hash match module 420 is defined as a hash result value of a file that already has a hazard, and the file is reconstructed from the file content hashing module 410 with the values stored in the existing hashing value table 421. To compare the values entered as hash result values.

In particular, the hash match function of the hash match module 420 is initiated by a hash match control signal provided by the metadata extraction module 430. When the hash match control signal is positive, a hash read signal is compared with a hash read value that triggers and reads an existing hash value table 421. The result value thus compared is transmitted to the detection result processing module 500 as part of the hash matching result.

The metadata extraction module 430 extracts file metadata for each file from incoming packets input based on the file file start indication signal provided from the file content hashing module 410.

The metadata matching module 440 generates and stores itself from the metadata entry table 450 when metadata values defined according to a specific file type are provided from the metadata extraction module 430. Read and compare existing metadata values. If the metadata value stored in the metadata entry table 450 acts as a whitelist, that is, if the hash matching result of the hash match module 420 is negative (file identified as a hash value) Is not harmful), the hash match control signal is sent negative to the hash match module 420, and the hash match module 420 sends a session reset signal to the file hashing module 410. It is possible to maintain high hashing-based matching performance of the device by not starting the file recombination process.

The metadata entry table 450 stores the file metadata extracted by the metadata extraction module 430. When the result of the hash match module 420 is negative, file metadata is stored by a metadata update signal that is enabled.

The metadata stored in the metadata entry table 450 is implemented in a structure that can be updated in real time to transmit metadata stored by a meta read signal from the metadata match module 440.

9 is a flowchart of an FPGA-based fast snort rule and Yarra rule matching method according to the present invention.

Referring to FIG. 9, the FPGA-based fast snort rule and the Yarra rule matching method according to the present invention include a rule conversion step S100, a pattern matching step S200, a hash matching step S300, and a packet forwarding step S400. It is composed.

Here, all four steps are implemented based on parallel processing that can communicate in real time and simultaneously process each function. In the rule conversion step, a rule conversion operation is performed in the CPU, and the result of the conversion, that is, the detection identifiers used in the present invention are stored in a memory on a hardware board with an FPGA and operated in the FPGA, a pattern matching step and a hash matching step. In addition, the packet forwarding step provides real-time information on rules required for packet-based processing. The rule conversion step can proceed regardless of whether the FPGA board is running when you want to apply the new snow rules and Yarra rules.

With reference to Figure 9 will be described step by step of each engine.

The function module in which the rule conversion step S100 operates is the detection rule converter 100.

The rule converting step S100 includes a snow rule and a Yarra rule editing step S110, a fixed pattern storing step S120, and a PCRE pattern storing step S130.

Snort rule and Yarra rule editing step (S110) is a fixed pattern storage stage (S120) and PCRE pattern storage step (S120) by converting the snort and Yarra rules into the form of the rule to be applied in the present invention ) Is stored in the memory on each allocated hardware board.

The fixed pattern storing step (S120) is an internal dual of the FPGA in which the detection engine 1000 operates so that fixed patterns converted from the snow and Yarra rules can be applied by the high speed packet processing module 200 in the detection engine 1000. It is stored in port RAM block memory.

In the PCRE pattern storage step S130, the PCRE pattern of the result values converted from the snow and Yarra rules is stored in a memory on the FPGA board. At this time, the data is stored in a form capable of programming the DFA detail engine prepared in the PCRE detection module 300 of the detection engine 1000. That is, when the processing result of the high speed packet processing module 200 for each packet is to perform PCRE pattern matching, the rule conversion engine (Rule Compilation Engine) based on the unique number of the pattern of the PCRE detection module 300 ) To execute the PCRE pattern operation immediately after programming DFA.

The pattern matching step S200 is implemented in the fast packet processing module 200, the PCRE detection module 300, and the dynamic hash and match control module 400.

Pattern matching step (S200) is a network packet receiving step (S210), packet parsing (Sparsing) step (S220), fixed pattern matching step (S230), PCRE pattern matching request step (S240), alc PCRE pattern matching step (S250) Is made of.

In the network packet receiving step (S210), an input packet is received, stored in the packet FIFO 600, and simultaneously delivered to the high speed packet processing module 200 for packet parsing (S220), and the L3 / L4 header value and pay Payload is distinguished. The contents corresponding to the payload among the extracted results are compared in real time with a fixed pattern stored in the FPGA in a fixed pattern matching step (S230). Fixed Pattern Matching When a result of detection is found, the rule number assigned to each failure pattern is identified. When the identified rule number is identified, the PCRE pattern matching request step (S240) determines whether there is a PCRE pattern applied to the corresponding rule.

In the case of a rule requiring PCRE pattern matching according to the result at this time, in the PCRE pattern matching step (S250), the related DFA is read from PCRE pattern storage so that the relevant PCRE pattern can be applied to the PCRE pattern matching of the present invention, and then the related DFA is programmed. Allows PCRE pattern matching to proceed.

In the hash matching step S300, the header value and the payload of the packet are received from the packet parsing step S220 of the pattern matching step, and the file reassembly step S310 is reconstructed based on the corresponding session. The MD5 hashing result of the reconstructed file is stored in a memory inside the FPGA in the file-based hash calculation and updater step (S320).

The stored value is calculated based on a hash value of the files reconstructed based on the additionally input packet and then compared with the stored hash values in hash value matching (S330).

The result of the comparison is transferred to the PCRE pattern matching request step S330, and it is determined whether or not to perform PCRE rule related (Yara rule matching).

The detection result processing step S340 is implemented in the detection result processing module 500, and generates a Mitigation Control signal based on the detection results from the pattern matching engine and the hash matching engine to be transmitted to the packet forwarding engine.

Packet forwarding step (S400) is composed of a packet buffering step (S410) and a mitigation policy application step (S420). After the processing in the pattern matching engine and the hash matching engine is completed for one input packet input, the mitigation control signal is When it is generated, it is recognized that the matching procedure for the corresponding packet is completed, and the packet is read out from the packet FIFO 600 to determine whether to relax (drop) the packet in the mitigation policy application step (S420). drop) and packet forwarding functions occur continuously.

As described above, the rule conversion step, the pattern matching step, the hash matching step, and the packet forwarding step simultaneously perform the respective functions to implement the detailed functions required by the present invention at FPGA-based ultra-high speed.

The present invention described above is limited to the above-described embodiments and the accompanying drawings as various substitutional modifications and changes are possible within a range without departing from the technical spirit of the present invention for those skilled in the art. It doesn't happen.

Claims (5)

A rule conversion step of converting the snort rule and the yarra rule in the detection rule converter to store the fixed pattern and the PCRE pattern in a memory on a hardware board;
A pattern matching step of receiving a packet input from a network based on the converted rule, parsing the packet in a packet FIFO and a fast packet processing module, and performing fixed pattern and PCRE pattern matching, respectively;
Receives the header value and payload of the packet from the packet parsing, reconstructs the file, stores it in a memory inside the FPGA, and matches the stored hash values based on the additionally input packet to match the mitigation control signal in the detection result processing module. A hash matching step occurring; And
And a packet forwarding step of sequentially generating packet drop and packet forwarding by determining whether to relax the packet by reading the packet from the packet FIFO.
The pattern matching step,
A network packet receiving step of receiving an input packet, storing the packet in a packet FIFO and simultaneously transferring the packet to a high speed packet processing module 200 for packet parsing and distinguishing between a header value and a payload;
The content corresponding to the payload of the extracted result is a fixed pattern matching step of comparing in real time with a fixed pattern stored in the FPGA;
A PCRE pattern matching request step of identifying whether there is a PCRE pattern applied to the corresponding rule when identifying the rule number assigned to each fixed pattern when a result of the fixed pattern matching detection is generated; And
A PCRE pattern matching step of allowing the PCRE pattern matching to proceed by reading the relevant PCRE pattern from the PCRE pattern storage and programming the related DFA so that the PCRE pattern matching can be applied to the PCRE pattern matching. Based fast snort rule and Yarra rule matching method. The method of claim 1,
The rule conversion step,
A snort rule and yarra rule editing step of converting the snort and yarra rules into a detection rule converter;
A fixed pattern storage step of storing fixed patterns converted from the snow rules and the Yarra rules in an internal dual port RAM block memory of an FPGA in which a detection engine operates so that the fixed patterns converted from the snort rules and the Yarra rules can be applied; And
And a PCRE pattern storage step of storing the PCRE pattern in the result value converted from the snort and Yarra rules in a memory on an FPGA board. delete The method of claim 1,
The hash matching step,
A file reassociation step of receiving a packet header value and a payload from the packet parsing and reconstructing a file based on the corresponding session;
A file based hash operation and updater for storing an MD5 hashing result of the reconstructed file in a memory inside the FPGA;
A hash value matching step of calculating hash values of files reconstructed based on an additionally input packet and comparing the hash values with stored hash values;
A PCRE pattern matching request step of determining whether or not to perform PCRE rule matching; And
And a detection result processing step of generating a mitigation control signal based on the detection results in the pattern matching step and the hash matching step and delivering the result to a packet forwarding engine. The method of claim 1,
The packet forwarding step,
A packet buffering step of receiving and buffering a packet input from a network; And
FPGA-based fast snort rule, comprising: a mitigation policy application step that reads the packet from the packet FIFO to determine whether to relax the packet to cause the packet drop and packet forwarding function to occur continuously And Yarra rule matching method.

Images