Fast policy matching with runtime signature update
Techniques for fast policy matching with runtime signature update are disclosed. In some embodiments, a system/process/computer program product for fast policy matching with runtime signature update includes receiving a plurality of rules for pattern-matching signatures; compiling the plurality of rules for a fast policy matching engine that detects malware using the pattern-matching signatures; and executing the compiled plurality of rules using the fast policy matching engine to detect a match using at least one of the pattern-matching signatures.
1 . A system, comprising:
a processor configured to:
receive a plurality of rules for pattern-matching signatures;
compile the plurality of rules for a fast policy matching engine that detects malware using the pattern-matching signatures; and
execute the compiled plurality of rules using the fast policy matching engine to detect a match using at least one of the pattern-matching signatures; and
a memory coupled to the processor and configured to provide the processor with instructions.
2 . The system of claim 1 , wherein the fast policy matching engine is for a layer 3 and layer 4 threat engine of a firewall.
3 . The system of claim 1 , wherein the fast policy matching engine is implemented in software.
4 . The system of claim 1 , wherein the fast policy matching engine is implemented in hardware.
5 . The system of claim 1 , wherein the fast policy matching engine includes a hash bucket evaluator for match, not match, and range.
6 . The system of claim 1 , wherein the pattern-matching signatures include malware signatures, and wherein the processor is further configured to perform runtime processing of incoming network packets to detect malware.
7 . The system of claim 1 , wherein the pattern-matching signatures comprise a set of user defined rules, and wherein the processor is further configured to compile the rules by performing the following:
parse each of a plurality of user defined rules to extract distinct fields; and
generate an evaluator for each of the extracted distinct fields.
8 . The system of claim 1 , wherein the pattern-matching signatures include malware signatures, and wherein the malware signatures comprise a set of user defined rules, and wherein the processor is further configured to compile the rules by performing the following:
parse each of a plurality of user defined rules to extract distinct fields;
generate a plurality of evaluators, wherein there is at least one evaluator for each of the extracted distinct fields; and
perform runtime processing of incoming network packets using one or more of the plurality of evaluators to detect malware.
9 . A method, comprising:
receiving a plurality of rules for pattern-matching signatures;
compiling the plurality of rules for a fast policy matching engine that detects malware using the pattern-matching signatures; and
executing the compiled plurality of rules using the fast policy matching engine to detect a match using at least one of the pattern-matching signatures.
10 . The method of claim 9 , wherein the fast policy matching engine is for a layer 3 and layer 4 threat engine of a firewall.
11 . The method of claim 9 , wherein the fast policy matching engine is implemented in software.
12 . The method of claim 9 , wherein the fast policy matching engine is implemented in hardware.
13 . The method of claim 9 , wherein the fast policy matching engine includes a hash bucket evaluator for match, not match, and range.
14 . The method of claim 9 , further comprising performing runtime processing of incoming network packets to detect malware.
15 . The method of claim 9 , further comprising:
parsing each of a plurality of user defined rules to extract distinct fields; and
generating an evaluator for each of the extracted distinct fields.
16 . The method of claim 9 , further comprising:
parsing each of a plurality of user defined rules to extract distinct fields;
generating a plurality of evaluators, wherein there is at least one evaluator for each of the extracted distinct fields; and
performing runtime processing of incoming network packets using one or more of the plurality of evaluators to detect malware.
17 . A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving a plurality of rules for pattern-matching signatures;
compiling the plurality of rules for a fast policy matching engine that detects malware using the pattern-matching signatures; and
executing the compiled plurality of rules using the fast policy matching engine to detect a match using at least one of the pattern-matching signatures.
18 . The computer program product of claim 17 , wherein the fast policy matching engine is for a layer 3 and layer 4 threat engine of a firewall.
19 . The computer program product of claim 17 , wherein the fast policy matching engine includes a hash bucket evaluator for match, not match, and range.
20 . The computer program product of claim 17 , further comprising computer instructions performing runtime processing of incoming network packets to detect malware.