METHOD OF PROVIDING EFFICIENT MATCHING MECHANISM USING INDEX GENERATION IN INTRUSION DETECTION SYSTEM

摘要

PURPOSE: An operation method of a trespass detection system is provided to compare the sub-signatures corresponding to an extracted index without comparing all signatures for a packet. CONSTITUTION: One or more sub-signatures are classified into groups which share an index. One of the classified groups is configured with candidate indices (101). When the index is included in an inputted packet based on the configured candidate indices, the inputted packet is inspected by using one or more sub-signatures regarding the index (102). A specific signature is randomly selected from the extracted signatures. A sub-string is extracted as a candidate index from the selected specific signature. [Reference numerals] (101) Reconfigure one or more sub-signatures as candidate indices; (102) Inspect an inputted packet based on the reconfigured candidate indices; (AA) Start; (BB) End