Pattern matching system, method and computer program product
View Patent ↗A pattern matching system, method and computer program product are provided. In use, a plurality of components of data is received, such that each component of the data is compared against a plurality of patterns. To this end, more than one match between the components of the data and the patterns can be identified.
1. A method, comprising:
receiving a plurality of components of data;
comparing each component of the data against a plurality of patterns, utilizing a micro-processor, wherein the patterns are representative of intrusion attacks;
establishing a first list including patterns that are potentially matched against the components of the data, wherein the patterns are determined to be potentially matched upon a first identification of a match between a portion of the plurality of components of the data and a portion of a plurality of portions of the patterns; and
identifying more than one complete match between the components of the data and each of the plurality of portions of the patterns in the first list;
wherein in response to the identification of a complete match between the plurality of components of the data and one or more of the patterns in the first list, each pattern on the first list for which a complete match is identified is moved from the first list to a second list;
wherein each component of the data is compared against each pattern of the plurality of patterns only once;
wherein one or more of the patterns are determined to be completely matched to the plurality of components of data upon a match between all of the plurality of components of the data and each of the plurality of portions of the pattern.
2. The method of claim 1 , wherein one of the patterns is potentially matched against the components of the data when only one of the plurality of portions of the pattern is matched.
3. The method of claim 1 , wherein the first list includes a linked list.
4. The method of claim 1 , wherein the patterns in the first list are removed from the first list upon violating a rule.
5. The method of claim 1 , wherein the patterns in the first list are maintained in the first list if it can not be confirmed that each of the plurality of portions of the patterns are completely matched against the components of the data.
6. The method of claim 1 , wherein the comparing utilizes a data structure for storing the patterns.
7. The method of claim 6 , wherein the data structure includes a plurality of indices.
8. The method of claim 7 , wherein each index correlates with a list of patterns.
9. The method of claim 8 , wherein a character associated with the index is the same as a first character of each of the patterns in the list.
10. The method of claim 8 , wherein the patterns in the list are prioritized.
11. The method of claim 10 , wherein the patterns in the list are prioritized based on a length thereof.
12. The method of claim 10 , wherein the comparing is carried out based on the prioritization.
13. The method of claim 10 , wherein patterns of shorter length are listed prior to patterns of longer length.
14. The method of claim 1 , wherein the second list only, includes the plurality of portions of the patterns that are complete matches.
15. The method of claim 1 , further comprising tracking, using at least one offset value, each pattern in the first list to ensure that an appropriate portion of each pattern is compared against each component of data.
16. The method of claim 1 , wherein the comparing each component of the data includes first determining if a first portion and a last portion of each of the plurality of patterns matches a corresponding data component of the plurality of components of data.
17. A computer program product embodied on a non-transitory computer readable medium, comprising:
computer code for receiving a plurality of components of data;
computer code for comparing, utilizing a hardware processor, the components of the data against a plurality of patterns, wherein the patterns are representative of intrusion attacks;
computer code for establishing a first list including patterns that are potentially matched against the components of the data, wherein the patterns are determined to be potentially matched upon a first identification of a match between a portion of the plurality of components of the data and a portion of a plurality of portions of the patterns; and
computer code for identifying more than one complete match between the components of the data and each of the plurality of portions of the patterns in the first list;
wherein the computer program product is operable such that in response to the identification of a complete match between the plurality of components of the data and one or more of the patterns in the first list, each pattern on the first list for which a complete match is identified is moved from the first list to a second list;
wherein each component of the data is compared against each pattern of the plurality of patterns only once;
wherein the computer program product is operable such that one or more of the patterns are determined to be completely matched to the plurality of components of data upon a match between all of the plurality of components of the data and each of the plurality of portions of the pattern.
18. A system, comprising:
an intrusion detection system including a micro-processor coupled to a memory for comparing each component of data against a plurality of patterns, wherein the patterns are representative of intrusion attacks;
wherein the system is operable such that a first list is established including patterns that are potentially matched against the components of the data, wherein the patterns are determined to be potentially matched upon a first identification of a match between a portion of the plurality of components of the data and a portion of a plurality of portions of the patterns; and
wherein the system is operable such that more than one complete match is identified between the components of the data and each of the plurality of portions of the patterns in the first list;
wherein the system is operable such that in response to the identification of a complete match between the plurality of components of the data and one or more of the patterns in the first list, each pattern on the first list for which a complete match is identified is moved from the first list to a second list;
wherein each component of the data is compared against each pattern of the plurality of patterns only once;
wherein the system is operable such that one or more of the patterns are determined to be completely matched to the plurality of components of data upon a match between all of the plurality of components of the data and each of the plurality of portions of the pattern.