WO2019139295A1

WO2019139295A1 - Character distribution-type memory access-based network intrusion detection system and method therefor

Info

Publication number: WO2019139295A1
Application number: PCT/KR2018/016976
Authority: WO
Inventors: 이호석
Original assignee: 주식회사 로그인어스
Priority date: 2018-01-12
Filing date: 2018-12-31
Publication date: 2019-07-18
Also published as: KR20190086107A; KR102055326B1

Abstract

The present invention relates to a character distribution-type memory access-based network intrusion detection system and a method therefor. The present invention may comprise: a first step of logically dividing a storage device portion (200) into a first character distribution storage module (200u-1) to an n^th character distribution storage module (200u-n) (n is a natural number which is equal to or larger than 2, and which is equal to or different from the number of all constituent characters); and a second step of extracting a character corresponding to the first character of a signature, extracting a pre-state ID (PSID) related to the extracted character, extracting a character distribution storage module (200u) matching with characters extracted from the first character distribution storage module (200u-1) to the n^th character distribution storage module (200u-n) of the storage device (200), performing signature detection with regard to each character, and performing character-specific memory access distribution on the storage device portion (200). Accordingly, the conventional scheme of storing a state transition table in a single memory and accessing the single memory according to the state is converted to a scheme of dividing a state transition table into character-specific tables, distributing/storing the same, and accessing each corresponding character-specific table according to the character, thereby providing the advantageous effect of substantially improving the efficiency of signature and PCRE detection.

Description

Network Intrusion Detection System Based on Character Distributed Memory Access and Its Method

The present invention relates to a network intrusion detection system based on character distributed memory access and a method thereof, and more particularly, to a system and method for detecting a network intrusion based on a character distributed memory access, The present invention relates to a network intrusion detection system based on a character distributed memory access and a method thereof for solving a bottleneck problem.

Signature-based security devices, each compiled with a list of intrusions, have been spotlighted as a system to cope with security problems caused by explosion of Internet use in recent years. However, It is too much time to compare all the registered signatures and payloads by separating the payloads.

In order to detect attacks that can not be represented by a lot of deformed and fixed character strings, security devices support Perl Compatible Regular Expressions (PCRE) engines, but they are slower and slower than sample strings It is a reality that uses shortcut.

More specifically, in order to overcome the time-consuming limitation of a conventional signature-based security device, a signature is searched using Non-deterministic Finite Automata (NFA) or Deterministic Finite Automata (DFA) .

In the Non-deterministic Finite Automata (NFA) or the Deterministic Finite Automata (DFA), by setting the next state number that can be divided around the first character in the signature on the Goto-graph using each state number , And reach the destination state number.

That is, referring to FIG. 1, a state transition table represented by a Goto table and a failure table in a conventional signature and PCRE search processor 10 is inputted on one memory device 20, When a signature is searched through a memory access by a processor, as the number and size of signatures increases, the number of state transitions increases and the number of memory accesses increases. In order to overcome this limit, there is an attempt to increase the number of processing processes or increase the performance of the processing process in a hardware manner. However, as the amount of traffic increases to one memory, the memory bottleneck phenomenon is solved There is a limit that can not be done.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and it is an object of the present invention to provide a method for storing a state transition table in one memory and accessing one memory according to a state, And a method for accessing each corresponding character-specific table according to a character, thereby greatly improving the efficiency of signature and PCRE search, and a method for searching for a network-based network intrusion search system based on a character distributed memory access .

In addition, the present invention solves the bottleneck problem through memory distribution for each character, but can solve the loop to the specific state number performing the same function as the setting of the transition function or the movement to the initial state number The present invention provides a system and method for searching for a network intrusion based on a character distributed memory access.

However, the objects of the present invention are not limited to the above-mentioned objects, and other objects not mentioned can be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, a method of searching for a network intrusion based on a character distributed memory access according to an embodiment of the present invention includes a step of dividing a storage unit 200 into a first character distribution storage module 200u- A first step of logically dividing the storage module 200u-n (n is a natural number equal to or greater than 2 as a whole constituent character); And a PSID (Pre-State ID) for the extracted character are extracted, and the first character distribution storage module 200u-1 to the nth character storage module 200u-1 of the storage unit 200 extracts a character corresponding to the first character of the signature, The character distribution storage module 200u matching the characters extracted from the character distribution storage module 200u-n is extracted and signature detection is performed for each character to perform character access memory access distribution on the storage unit 200 A second step; And a control unit.

In order to achieve the above object, according to another embodiment of the present invention, there is provided a method for searching for a network intrusion based on character scattered memory access, wherein a character dispersed access device unit 100 extracts a character corresponding to a first character of a signature, A first step of extracting a PSID (Pre-State ID) for the extracted character; The character dispersed access device unit 100 may be a character distributed storage device that matches characters extracted from the first character distribution storage module 200u-1 to the nth character distribution storage module 200u-n of the storage unit 200, A second step of extracting the module 200u; Corresponding to the state number corresponding to the state number corresponding to the PSID in the PSID_Valid table 210 of the character scatter distributed storage module 200u from which the character scattered access unit 100 is extracted A third step of verifying information of 1 bit (1, 0) for informing whether a progress state number or SID (State number ID) exists; And the character scattered access device 100 checks if the bit of the PSID position of the PSID_V table 210 identified in the third step is '1' (bit of PSID_V table = '1'), PSID_V (VC table) corresponding to the row matched with the summed number after summing the number of '1's' to the corresponding bit in the row corresponding to the PSID value of the table (PSID_V table) 210 A fourth step of extracting an SID value on a SID table (SID table) 230, which is summed with the value of the SID table 220; And a control unit.

In the method of searching for a network intrusion based on character distributed memory access according to another embodiment of the present invention, in the first step, the character dispersed access device 100 extracts a character corresponding to a first character of a signature And the packet ID of the data is generated beforehand.

In addition, in the method of searching for a network intrusion based on a character distributed memory access according to yet another embodiment of the present invention, the character scattered access device unit 100 transmits SID information as PSID information to the next character The character distribution storage module 200u matching the characters extracted from the first character distribution storage module 200u-1 to the nth character distribution storage module 200u-n of the storage unit 200 is extracted, A fifth step of performing the first step to the fourth step according to all the signature lists; .

Also, in the method of searching for a network intrusion based on character distributed memory access according to yet another embodiment of the present invention, the fourth step may include a PSID_V table (PSID_V table) 210 identified in the third step The character scattered access device 100 reads the PSID_V table 210 of the move table 240 when the bit of the PSID_V table is '0' (bit of PSID_V table = '0' 4-1) extracting the SID information using the position information matched with the position bit value of the SID; .

In addition, in the method of searching for a network intrusion based on character distributed memory access according to yet another embodiment of the present invention, after the step 4-1, when the character scattered access device unit 100 receives a move table 240 (Bit of Move table = '0') of the position matched with the position bit value of the PSID_V table 210 of the PSID_V table 210 is determined to be '0'. .

In addition, the method for searching for a network intrusion based on character distributed memory access according to another embodiment of the present invention may further include, after step 4-2, a PSID_Valid table 210 of a move table 240 , The character scattered access device 100 moves to the determined initial state SID, and then moves to the initial state SID of the storage device 200 corresponding to the next character The character distribution storage module 200u matching the characters extracted from the first character distribution storage module 200u-1 to the nth character distribution storage module 200u-n is extracted and the first through A fourth step of performing the process of the fourth step according to all the signature lists; .

In order to achieve the above object, according to an embodiment of the present invention, there is provided a system for searching for a network intrusion based on character distributed memory access, comprising: a first character distribution storage module 200u-1 to an nth character distribution storage module 200u- (n is a natural number equal to or greater than 2 and equal to or different from the entire configuration character); And a PSID (Pre-State ID) for the extracted character are extracted, and the first character distribution storage module 200u-1 to the nth character storage module 200u-1 of the storage unit 200 extracts a character corresponding to the first character of the signature, The character distribution storage module 200u matching the characters extracted from the character distribution storage module 200u-n is extracted and signature detection is performed for each character to perform character access memory access distribution on the storage unit 200 A character dispersed access device unit 100; . &Lt; / RTI >

A network intrusion detection system based on a character distributed memory access and a method thereof according to an embodiment of the present invention includes a state transition table storing unit for storing a state transition table in one memory, By dividing the state transaction table into character-by-character tables, and storing the character-by-character table in a distributed manner, the signature and PCRE search efficiency can be dramatically improved.

In addition, the system for searching for a network intrusion based on character scattered memory access and the method thereof according to another embodiment of the present invention solve the bottleneck problem through memory distribution for each character, It is also possible to solve the problem of moving to a loop or an initial state number for a specific state number to be performed.

FIG. 1 is a view for explaining a conventional bottleneck phenomenon by a signature and a PCRE search processor 10. FIG.

2 is a diagram illustrating a network intrusion detection system based on a character distributed memory access according to an embodiment of the present invention.

3 illustrates a configuration of a PSID_Valid table 210 formed in a character distribution storage module 200u of a storage unit 200 of a network intrusion detection system based on a character distributed memory access according to an embodiment of the present invention. Fig.

FIG. 4 is a block diagram illustrating a VC table (Valid Count table) 220 formed in the character distribution storage module 200u of the storage unit 200 among the network intrusion detection systems based on the character distributed memory access according to the embodiment of the present invention, (State ID) table (SID table) 230 shown in FIG.

5 is a diagram illustrating a configuration of a move table 240 formed in the character distribution storage module 200u of the storage unit 200 among the network intrusion detection systems based on the character distributed memory access according to the embodiment of the present invention, (Move table) 240 and a SID_V table (PSID_Valid table) 210. In the example of FIG.

FIG. 6 is a flowchart illustrating a method of searching for a network intrusion based on a character distributed memory access according to an embodiment of the present invention.

The present invention can be variously modified and may have various embodiments, and specific embodiments will be described in detail with reference to the drawings. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

Terms including ordinals, such as first, second, etc., may be used to describe various elements, but the elements are not limited to these terms. The terms are used only for the purpose of distinguishing one component from another.

For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the meaning in the context of the relevant art and are to be construed as ideal or overly formal in meaning unless explicitly defined in the present application Do not.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout. In this process, the thicknesses of the lines and the sizes of the components shown in the drawings may be exaggerated for clarity and convenience of explanation. In addition, the terms described below are defined in consideration of the functions of the present invention, which may vary depending on the intention or custom of the user, the operator. Therefore, definitions of these terms should be made based on the contents throughout this specification.

2 is a diagram illustrating a network intrusion detection system based on a character distributed memory access according to an embodiment of the present invention. 3 illustrates a configuration of a PSID_Valid table 210 formed in a character distribution storage module 200u of a storage unit 200 of a network intrusion detection system based on a character distributed memory access according to an embodiment of the present invention. Fig. FIG. 4 is a block diagram illustrating a VC table (Valid Count table) 220 formed in the character distribution storage module 200u of the storage unit 200 among the network intrusion detection systems based on the character distributed memory access according to the embodiment of the present invention, (State ID) table (SID table) 230 shown in FIG. 5 is a diagram illustrating a configuration of a move table 240 formed in the character distribution storage module 200u of the storage unit 200 among the network intrusion detection systems based on the character distributed memory access according to the embodiment of the present invention, (Move table) 240 and a SID_V table (PSID_Valid table) 210. In the example of FIG.

2, the network intrusion detection system 1 based on character scattered memory access may include a character scattered access device unit 100 and a storage unit 200 as two large components .

The character dispersed access unit 100 includes a transceiver unit 110, a control unit 120 and an input / output interface 130. The control unit 120 includes a character extraction module 121 ), A state search module 122, a first progress state extraction module 123, and a second progress state extraction module 124.

In this specification, a module may mean a functional and structural combination of hardware for carrying out the technical idea of the present invention and software for driving the hardware. For example, the module may mean a logical unit of a predetermined code and a hardware resource for executing the predetermined code, and it does not necessarily mean a physically connected code or a kind of hardware. Can be easily deduced to the average expert in the field of < / RTI >

Meanwhile, the storage unit 200 is a non-volatile memory (NVM) that does not lose power even if power is not supplied, and is not deleted, and may be a flash memory, an MRAM (Magnetic Random Access Memory) , Phase-change random access memory (PRAM), ferroelectric random access memory (FRAM), or volatile memory or other memory storage devices.

The storage unit 200 logically stores the first character distribution storage module 200u-1 to the nth character distribution storage module 200u-n (where n is a natural number equal to or different from that of the entire configuration character) Can be distinguished.

Hereinafter, a character intrusion detection system based on a character dispersed type memory access will be described in detail with reference to components of the control unit 120 of the character scattered access device 100. FIG.

The character extracting module 121 extracts an n-tuple (m-tuple) m (m-tuple) when a packet, a payload or user data is inputted from an external communication network or an external device through the transceiver 110 (N is a natural number equal to or different from n), and generates a packet ID, extracts a character corresponding to the first character of the signature among the character strings extracted from the payload or the user data The extracted character, and the PSID (Pre-State ID) and the packet ID for the extracted character to the PSID state search module 122. To this end, the character extraction module 121 may have a separate memory storing the first character of the previously registered signature, or may be provided with access to the storage unit 200 in which the first character of the previously registered signature is stored in advance ) To control the input / output I / F 130 to detect whether the input / output I / F 130 is correct.

The state search module 122 receives the packet ID, the character, and the PSID (Pre-State ID) extracted by the character extraction module 121 and then transmits the first character distribution storage module 200u- 1) to the nth character distribution storage module 200u-n. The character distribution storage module 200u matches the character extracted from the nth character distribution storage module 200u-n. The state search module 122 then searches for a character extracted from the state number corresponding to the PSID in the PSID_V table 210 (FIG. 3B) included in the extracted character distribution storage module 200u, (1, 0) to indicate whether there is a progress state number or a SID (State number ID) corresponding to the number is "1 ".

That is, the state search module 122 accesses the PSID_Valid table 210 with the received PSID (Pre-State ID) bits to check whether the PSID location is available ('1') , It is possible to search whether or not the character for the received PSID (Pre-State ID) corresponds to the character assigned to the extracted character distribution storage module 200u.

Meanwhile, the PSID_Val table 210 is a table in which each character string on a state transition table generated for searching for a signature in a conventional NFA (Non-deterministic Finite Automata) or DFA (Deterministic Finite Automata) (1, 0) information for notifying the presence or absence of a state number or a SID (State number ID) for each cell to be extracted and rearranged, By constructing a table for each character constituting each state transition table, it is possible to arrange a state transaction in the storage unit 200 corresponding to one memory device by the character distributed access device unit 100, By allowing distribution to be performed by accessing each character-specific table rather than accessing a table (state transition table), a memory bottleneck (Memory bottleneck phenomenon.

The first progress state extraction module 123 extracts the PSID_V table 210 from the PSID_V table 210 if the bit of the PSID position of the PSID_V table 210 is '1' (bit of PSID_V table = '1' A valid table 220 (see FIG. 4A) corresponding to a row matched with the summed number is added to the number of '1' s to a corresponding bit in the row corresponding to the PSID value, (SID) table (SID table) 230 (see FIG. 4B), which is summed and matched with the value of the SID table 230 (see FIG.

The SID table 230 is stored together with the VC table 220 in the character distribution storage module 200u extracted by the state search module 122 so that the SID_V table (PSID_V table) (VC table) 220 to the corresponding bit in the row corresponding to the PSID value of the table 210 and sets the value as a Match value. The SID of the column corresponding to the Match value So that the value can be extracted as the SID value corresponding to the proceeding state number to be processed next.

That is, the first progress state extraction module 123 accesses the SID table 230 to analyze Match ('1': match) information and SID information, and then transmits SID information together with the packet ID To the character extraction module 121, so that the above-described process for the next character corresponding to the signature can be performed.

More specifically, the first progress state extracting module 123 provides the SID information to the character extracting module 121 so that the SID information is converted into the PSID information according to the control of the character extracting module 121, The character distribution storage module 200u matching the characters extracted from the first character distribution storage module 200u-1 to the nth character distribution storage module 200u-n of the unit 200 is extracted, To the state search module 122 together with the packet ID.

The second progress state extracting module 124 determines whether the bit of the PSID position of the PSID_V table 210 is '0' (bit of PSID_V table = '0'), (SID) information to the packet ID and character extraction module 121 by using the position information matched with the position bit value of the PSID_V table 210 of the PSID_V table (FIG. 5B), thereby adding the SID information to the next character corresponding to the signature .

Here, the move table 240 is formed to have the same structure as the cell grid (mxl) of the PSID_V table 210, so that the PSID_V table 210 corresponding to the order of the received PSID (Pre-State ID) ), If there is no progress state number in the PSID bit of '0' (bit of PSID_V table = '0'), then to return to the state number corresponding to the initial state SID and the repetition of the inputted PSID, A cell can be created with 1 bit (0 or 1).

Accordingly, the second progress state extraction module 124 should proceed to the next initial state SID if the value extracted from the move table 240 is '0' (bit of Move table = '0') If the value extracted from the move table 240 is '1' (bit of Move table = '1'), the character extraction module 121 may provide the SID value corresponding to the progress state number. The present invention provides an effect of setting a transition function while solving the bottleneck problem through memory distribution by character by providing the input PSID to the character extraction module 121 (keep now state).

FIG. 6 is a flowchart illustrating a method of searching for a network intrusion based on a character distributed memory access according to an embodiment of the present invention. 6, the character scattered access device 100 generates a packet ID of data received from the outside, extracts a character corresponding to the first character of the signature, and then generates a PSID (Pre- State ID) is extracted (S11).

After the step S11, the character scattered access device 100 acquires the characters extracted from the first character distribution storage module 200u-1 to the nth character distribution storage module 200u-n of the storage unit 200 The character distribution storage module 200u is extracted (S12).

After step S12, the character scattered access device 100 reads the character extracted from the state number corresponding to the PSID in the PSID_V table 210 of the extracted character distribution storage module 200u (1, 0) information for informing whether there is a progress state number or a SID (State number ID) corresponding to the next state number (S13).

After step S13, the character scattered access device unit 100 determines whether the information of 1 bit identified in step S13 is " 1 "(S14).

As a result of the determination in step S14, if the bit of the PSID position of the PSID_V table 210 identified in step S13 is '1' (bit of PSID_V table = '1'), unit 100 PSID_V table (PSID_V table) (210) behind one of summing the row corresponding to the PSID values the number of '1' to the corresponding bit (bit), VC for the matching and the summed number row The SID value on the SID table 230 is summed with the value of the VC table 220 in step S15.

After step S15, the character scattered access device 100 transmits SID information as PSID information to the first character distribution storage module 200u-1 to the n-th character disperse storage module 200u-1 of the storage unit 200 corresponding to the next character The character distribution storage module 200u that matches the character extracted from the storage module 200u-n is extracted and the process of steps S11 to S15 for the next character is performed according to all the signature lists (S16) .

On the other hand, if the bit of the PSID position of the PSID_V table 210 identified in step S13 is '0' (bit of PSID_V table = '0') as a result of the determination of step S14, The distributed access device 100 extracts the SID information using position information matching the position bit value of the PSID_V table 210 among the move table 240 in step S17.

After step S17, the character scattered access device 100 checks whether the bit value of the position matched with the position bit value of the PSID_V table 210 of the MOVE table 240 is "0" (Bit of Move table = '0') (S19).

If the bit value of the position matched with the position bit value of the PSID_V table 210 of the MOVE table 240 is "0 " as a result of the determination of step S19, The first and second character distributing and storing modules 200u-1 to 200u-n of the storage unit 200 corresponding to the next character The character distribution storage module 200u matching the extracted character is extracted and the process of steps S11 to S15 for the next character is performed according to all the signature lists (S20).

On the other hand, if it is determined in step S19 that the bit value of the position matched with the position bit value of the PSID_V table 210 of the MOVE table 240 is "1 & The access device unit 100 moves to the PSID extracted in step S11 and then transmits the PSID to the first character distribution storage module 200u-1 to the nth character distribution storage module 200u-1 of the storage unit 200 corresponding to the next character The character distribution storage module 200u matching the character extracted from the character extraction unit 200u-n is extracted and the process of step S11 to step S15 for the next character is performed according to all the signature lists at step S21.

The present invention can also be embodied as computer-readable codes on a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored.

Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device and the like, and also implemented in the form of a carrier wave (for example, transmission over the Internet) .

The computer readable recording medium may also be distributed over a networked computer system so that computer readable code can be stored and executed in a distributed manner. And functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers skilled in the art to which the present invention pertains.

As described above, preferred embodiments of the present invention have been disclosed in the present specification and drawings, and although specific terms have been used, they have been used only in a general sense to easily describe the technical contents of the present invention and to facilitate understanding of the invention , And are not intended to limit the scope of the present invention. It is to be understood by those skilled in the art that other modifications based on the technical idea of the present invention are possible in addition to the embodiments disclosed herein.

Claims

The storage unit 200 is logically divided into the first character distribution storage module 200u-1 to the nth character distribution storage module 200u-n (n is equal to or more than 2 as a whole constituent character) A first step; And

The PSID (Pre-State ID) of the extracted character is extracted after the character corresponding to the first character of the signature is extracted, and the first character distribution storage module 200u-1 to the nth character A character distributing and storing module 200u that matches a character extracted from the distributed storage module 200u-n is extracted to perform signature detection for each character to distribute memory access for each character on the storage unit 200 Step 2; The method comprising the steps of: (a) searching for a network intrusion based on a character distributed memory access.
A first step of extracting a character corresponding to a first character of the signature and a PSID (Pre-State ID) of the extracted character after the character scatter access device unit 100 extracts the character corresponding to the first character of the signature;

The character dispersed access device unit 100 may be a character distributed storage device that matches characters extracted from the first character distribution storage module 200u-1 to the nth character distribution storage module 200u-n of the storage unit 200, A second step of extracting the module 200u;

Corresponding to the state number corresponding to the state number corresponding to the PSID in the PSID_Valid table 210 of the character scatter distributed storage module 200u from which the character scattered access unit 100 is extracted A third step of verifying information of 1 bit (1, 0) for informing whether a progress state number or SID (State number ID) exists; And

When the character scattered access device 100 determines that the bit of the PSID position of the PSID_V table 210 identified in the third step is '1' (bit of PSID_V table = '1'), the PSID_V table (VC table) 220 corresponding to a row matched with the summed numbers after summing the number of '1' s to the corresponding bit in the row corresponding to the PSID value of the PSID_V table 210 (SID) table 230, which is a sum of the SID value and the SID value; The method comprising the steps of: (a) searching for a network intrusion based on a character distributed memory access.
The method according to claim 2,

Characterized in that the character scattered access device (100) generates a packet ID of data before extracting a character corresponding to the first character of the signature.
4. The method of claim 3,

The character dispersed access device unit 100 stores the SID information as the PSID information in the first character distribution storage module 200u-1 to the nth character distribution storage module 200u-n of the storage unit 200 corresponding to the next character A fifth step of extracting the character distribution storage module 200u matching the extracted character and performing the first to fourth steps for the next character according to all the signature lists; Further comprising the step of: detecting a network intrusion based on a character distributed memory access.
4. The method of claim 3,

If the bit of the PSID position of the PSID_V table 210 identified in the third step is '0' (bit of PSID_V table = '0'), the character dispersed access device unit 100 (4-1) extracting SID information using position information matched with a position bit value of a PSID_V table (210) among a move table (240); Further comprising the step of: detecting a network intrusion based on a character distributed memory access.
[6] The method of claim 5,

The character scattered access device 100 checks whether the bit value of the position matched with the position bit value of the PSID_V table 210 among the move table 240 is " table = " 0 "); Further comprising the step of: detecting a network intrusion based on a character distributed memory access.
The method as claimed in claim 6,

When the bit value of the position matched with the position bit value of the PSID_V table 210 is "0" among the move table 240, the character scattered access device 100 sets the initial state SID, and then the characters dispersed and stored in the first character distribution storage module 200u-1 through the nth character distribution storage module 200u-n of the storage unit 200 corresponding to the next character A fourth step of extracting the storage module 200u and performing the first through fourth steps for the next character according to all the signature lists; Further comprising the step of: detecting a network intrusion based on a character distributed memory access.
A storage unit 200 logically divided into a first character distributed storage module 200u-1 to an nth character distributed storage module 200u-n (n is equal to or more than 2 as a whole constituent character); And

The PSID (Pre-State ID) of the extracted character is extracted after the character corresponding to the first character of the signature is extracted, and the first character distribution storage module 200u-1 to the nth character A character distributing and storing module 200u that matches a character extracted from the distributed storage module 200u-n is extracted to perform signature detection for each character and a character for performing character access memory access distribution on the storage unit 200 A distributed access device part (100); Wherein the network intrusion detection system is based on a character distributed memory access.