Methods and systems for full pattern matching in hardware
Methods and systems are provided for hardware-based pattern matching. In an embodiment, an intrusion-prevention system (IPS) identifies a full match between a subject data word comprising subject-data blocks and a signature data pattern comprising signature-data blocks. The IPS receives the subject data word via a network interface, and thereafter makes a partial-match determination that two or more but less than all of the subject-data blocks respectively match the same number of the signature-data blocks stored in partial-match hardware with respect to both value and position. Thereafter, the IPS makes a full-match determination that all of the subject-data blocks respectively match all of the signature-data blocks stored in the IPS's full-match hardware with respect to both value and position. The IPS then stores an indicator that the full-match determination has been made, and may carry out one or more additional intrusion-prevention responses as well.
1. A method of intrusion prevention for protecting a computer network, the method comprising:
generating, via an intrusion-prevention system (IPS), a plurality of pre-processing-signature-pattern-hash results for a signature data pattern, wherein the IPS includes a processor and hardware;
mapping, via the IPS, the signature data pattern to a first pre-processing memory address of a first memory device and a second pre-processing memory address of a second memory device based on the pre-processing-signature-pattern-hash results;
flagging, via the IPS, the first pre-processing memory address of the first memory device and the second pre-processing memory address of the second memory device;
receiving, via a network interface of the IPS, a subject data word;
generating, via the IPS, a plurality of pre-processing-subject-hash results for the subject data word;
mapping, via the IPS, the subject data word to a first subject data word pre-processing memory address of the first memory device and a second subject data word pre-processing memory address of the second memory device based on the corresponding pre-processing-subject-hash results;
performing, via the IPS, subsequent to a determination that the first subject data word pre-processing memory address of the first memory device is the same as the flagged first pre-processing memory address and the second subject data word pre-processing memory address of the second memory device is the same as the flagged second pre-processing memory address, a partial-match determination including determining that a partial-match number of a plurality of subject-data blocks of the subject data word respectively have a same block value at a same block position as the same partial-match number of a plurality of signature-data blocks of the signature data pattern;
performing, via the IPS, subsequent to making the partial-match determination, a full-match determination comprising a determination that all of the subject-data blocks respectively have a same block value at a same block position as all of the signature data blocks; and
subsequent to making the full-match determination, indicating that the subject data word comprises a known threat to the computer network.
2. The method of claim 1 , wherein the partial match number is greater than or equal to two and is less than a total number of the subject data blocks.
3. An intrusion-prevention system (IPS) for protecting a computer network, the IPS comprising:
a processor;
a network interface; and
hardware and data storage containing instructions that when executed by the processor cause the IPS to:
generate a plurality of pre-processing-signature-pattern-hash results for a plurality of signature data patterns;
map each of the plurality of pre-processing-signature-hash results to a respective first pre-processing memory address of a first memory device and a respective second pre-processing memory address of a second memory device based on the corresponding pre-processing-signature-hash results;
flag the first pre-processing memory address and the second pre-processing memory address;
receive a subject data word via the network interface;
generate a plurality of pre-processing-subject-hash results for the subject data word;
map the subject data word to a first subject data word pre-processing memory address of the first memory device and a second subject data word pre-processing memory address of the second memory device based on the corresponding pre-processing-subject-hash results;
perform subsequent to a determination that the first subject data word pre-processing memory address of the first memory device is the same as the flagged first pre-processing memory address and the second subject data word pre-processing memory address of the second memory device is the same as the flagged second pre-processing memory address, a partial-match determination including determining that a partial-match number of a plurality of subject-data blocks of the subject data word respectively have a same block value at a same block position as the same partial-match number of a plurality of signature-data blocks of the signature data pattern;
perform subsequent to making the partial-match determination, a full-match determination comprising a determination that all of the subject-data blocks respectively have a same block value at a same block position as all of the signature-data blocks; and
subsequent to making the full-match determination, indicate that the subject data word comprises a known threat to the computer network.
4. The IPS of claim 3 , embodied in a single network device.
5. The IPS of claim 3 , distributed across multiple network devices.