METHOD OF PROVIDING EFFICIENT MATCHING MECHANISM USING INDEX BASED ON N-GRAM MODEL GENERATION IN INTRUSION DETECTION SYSTEM

摘要

PURPOSE: An IDS operating method providing efficient high speed mechanism by generating an N-gram model-based index is provided to check a signature of an IDS by extracting the N-gram model-based index and suggesting match mechanism using the index. CONSTITUTION: An index about a signature is generated based on an N-gram model (101). The frequency of the index is calculated (102). A candidate IDS is reformed by relating the index and a sub signature including the index based on the frequency (103). An input packet is checked based on the reformed candidate IDS. The index is calculated by extracting signatures from a database, selecting a specific signature from the signatures, and performing N-gram operation with a fixed L length. [Reference numerals] (101) Index about a signature is generated based on an N-gram model; (102) Frequency of the index is calculated; (103) Candidate IDS is reformed by relating the index and a sub signature including the index based on the frequency; (104) Input packet is checked based on the reformed candidate IDS; (AA) Start; (BB) End