Network intrusion detection apparatus and method using Perl compatible regular expressions-based pattern matching technique

Patent metadata

Field	Value
Publication number	US-9444828-B2
Application number	US-201314023635-A
Country	US
Kind code	B2
Filing date	Sep 11, 2013
Priority date	Nov 1, 2012
Publication date	Sep 13, 2016
Grant date	Sep 13, 2016

Abstract

A network intrusion detection apparatus and method that perform Perl Compatible Regular Expressions (PCRE)-based pattern matching on the payloads of packets using a network processor equipped with a Deterministic Finite Automata (DFA) engine. The network intrusion detection apparatus includes a network processor core for receiving packets from a network, and transmitting payloads of the received packets to a Deterministic Finite Automata (DFA) engine. A detection rule converter converts a PCRE-based detection rule, preset to detect an attack packet, into a detection rule including a pattern to which only PCRE grammar corresponding to the DFA engine is applied. The DFA engine performs PCRE pattern matching on the payloads of the packets based on the detection rule converted by the detection rule converter.

First claim

What is claimed is:

1. A network intrusion detection apparatus comprising:
a non-transitory computer-readable medium recording programs for realizing following functions, the functions comprising:
a network processor core for receiving packets from a network, and transmitting payloads of the received packets to a Deterministic Finite Automata (DFA) engine;
a detection rule converter for converting a Perl Compatible Regular Expressions (PCRE)-based detection rule, preset to detect an attack packet, into a detection rule including a pattern to which only PCRE grammar corresponding to the DFA engine is applied, so that the DFA en performs matching on a pattern including PCRE grammar supported by the DFA engine, and the network processor core performs PCRE pattern matching on a pattern to which PCRE grammar not supported by the DFA engine is applied; and
the DFA engine for performing PCRE pattern matching on the payloads of the packets based on the detection rule converted by the detection rule converter,
wherein the DFA engine performs PCRE pattern matching based on hardware, while the network processor core performs PCRE pattern matching based on software using PCRE library.

2. The network intrusion detection apparatus of claim 1 , wherein the detection rule converter extracts the pattern to which only the PCRE grammar corresponding to the DFA engine is applied, from all patterns of the PCRE-based detection rule, adds the extracted pattern to the PCRE-based detection rule, and then converts the PCRE-based detection rule into the detection rule including the pattern to which only the PCRE grammar corresponding to the DFA engine is applied.

3. The network intrusion detection apparatus of claim 2 , wherein the DFA engine performs PCRE pattern matching on the payloads of the packets based on the pattern to which only the PCRE grammar corresponding to the DFA engine is applied and which is added to the PCRE-based detection rule.

4. The network intrusion detection apparatus of claim 3 , wherein the network processor core performs PCRE pattern matching only on a payload of a packet on which PCRE pattern matching has been successfully performed by the DFA engine.

5. The network intrusion detection apparatus of claim 4 , wherein the network processor core is configured to, if PCRE pattern matching has been successfully performed by the DFA engine, and a pattern to which PCRE grammar, not corresponding to the DFA engine, is applied is present in the PCRE-based detection rule, perform PCRE pattern matching only on a payload of a packet on which PCRE pattern matching has been successfully performed by the DFA engine among the payloads of the packets received from the network.

6. The network intrusion detection apparatus of claim 5 , wherein the network processor core does not perform PCRE pattern matching on the payloads of the packets received from the network if PCRE pattern matching has been unsuccessfully performed by the DFA engine.

7. The network intrusion detection apparatus of claim 6 , wherein the network processor core performs PCRE pattern matching on the payloads of the packets received from the network using a PCRE library.

8. The network intrusion detection apparatus of claim 2 , wherein the detection rule converter assigns a separate identifier to the extracted pattern so as to distinguish the extracted pattern from patterns to which PCRE grammar, not corresponding to the DFA engine, is applied, and adds a resulting pattern to the PCRE-based detection rule.

9. A network intrusion detection method comprising:
converting a Perl Compatible Regular Expressions (PCRE)-based detection rule, preset to detect an attack packet, into a detection rule including a pattern to which only PCRE grammar corresponding to a DFA engine is applied, so that the DFA engine performs PCRE pattern matching on a pattern including PCRE grammar supported by the DFA engine, and a network processor core performs PCRE pattern matching on a pattern to which PCRE grammar not supported by the DFA engine is applied;
receiving, by the network processor core, packets from a network;
transmitting, by the network processor core, payloads of the received packets to the DFA engine; and
performing, by the DFA engine, PCRE pattern matching on the payloads of the packets based on the converted detection rule,
wherein the DFA engine performs PCRE pattern matching based on hardware while the network processor core performs PCRE pattern matching based on software using PCRE library.

10. The network intrusion detection method of claim 9 , wherein converting the PCRE-based detection rule into the detection rule including the pattern to which only PCRE grammar corresponding to the DFA engine is applied comprises:
extracting the pattern to which only the PCRE grammar corresponding to the DFA engine is applied, from all patterns of the PCRE-based detection Me; and
adding the extracted pattern to the PCRE-based detection rule, and then converting the PCRE-based detection rule into the detection rule including the pattern to which only the PCRE grammar corresponding to the DFA engine is applied.

11. The network intrusion detection method of claim 10 , wherein performing, by the DFA engine, the PCRE pattern matching on the payloads of the packets is configured to perform PCRE pattern matching on the payloads of the packets based on the pattern to which only the PCRE grammar corresponding to the DFA engine is applied and which is added to the PCRE-based detection rule.

12. The network intrusion detection method of claim 11 , further comprising:
performing, by the network processor core, PCRE pattern matching only on a payload of a packet on which PCRE pattern matching has been successfully performed by the DFA engine.

13. The network intrusion detection method of claim 12 , wherein performing, by the network processor core, the PCRE pattern matching only on the payload of the packet on which PCRE pattern matching has been successfully performed by the DFA engine is configured to, if PCRE pattern matching has been successfully performed by the DFA engine, and a pattern to which PCRE grammar, not corresponding to the DFA engine, is applied is present in the PCRE-based detection rule, perform PCRE pattern matching only on a payload of a packet on which PCRE pattern matching has been successfully performed by the DFA engine among the payloads of the packets received from the network.

14. The network intrusion detection method of claim 13 , wherein performing, by the network processor core, the PCRE pattern matching only on the payload of the packet on which PCRE pattern matching has been successfully performed by the DFA engine is configured such that, if PCRE pattern matching has been unsuccessfully performed by the DFA engine, PCRE pattern matching is not performed on the payloads of the packets received from the network.

15. The network intrusion detection method of claim 14 , wherein performing, by the network processor core, the PCRE pattern matching only on the payload of the packet on which PCRE pattern matching has been successfully performed by the DFA engine is configured to perform PCRE pattern matching on the payloads of the packets received from the network using a PCRE library.

16. The network intrusion detection method of claim 10 , wherein adding the extracted pattern to the PCRE-based detection rule and then converting the PCRE-based detection rule into the detection rule including the pattern to which only the PCRE grammar corresponding to the DFA engine is applied is configured to assign a separate identifier to the extracted pattern so

Assignees

• Electronics & Telecommunications Res Inst
• Electronics And Telecommunications Reserach Inst

Inventors

• Lee Sung-Ryoul
• Choi Young-Han
• Lee Jung-Hee
• Bae Byung-Chul
• Oh Hyung-Geun
• Sohn Ki-Wook

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L2012/5603

  Access techniques · CPC title