PCRE PCRE Code processor for signature and PCRE search and method for searching signature and PCRE using the same

摘要

The present invention relates to a code processor for searching for a signature and a PCRE and a method for searching for a signature and a PCRE by using the same. The present invention is characterized by parsing a packet or a payload when the packet or the payload is input to divide the same into n tuples (where n is an integer greater than or equal to two), performing patterning or PCRE searching for the payload through at least one state processing step set to each character, changing the performance result into a preset format, and transmitting the same. A detecting method using a conventional finite automata as a method for increasing signature and PCRE detecting performance of signature-based security equipment stores a state transaction table generated by using finite automata in a high-capacity memory and searches for a next state by referring to the state transaction table. Thus, the problem of performance degradation issue due to a memory bottleneck effect can be solved by logically distributing the state transaction table by character to overcome a limitation that the overall process performance is determined by memory performance.