Data pattern analysis using optimized deterministic finite automation
View Patent ↗Techniques for data pattern analysis using deterministic finite automaton are described herein. In one embodiment, a number of transitions from a current node to one or more subsequent nodes representing one or more sequences of data patterns is determined, where each of the current node and subsequent nodes is associated with a deterministic finite automaton (DFA) state. A data structure is dynamically allocated for each of the subsequent nodes for storing information associated with each of the subsequent nodes, where data structures for the subsequent nodes are allocated in an array maintained by a data structure corresponding to the current node if the number of transitions is greater than a predetermined threshold. Other methods and apparatuses are also described.
1. A method for data pattern analysis of one or more packets, the method comprising:
a processor executing instructions residing in memory thereby inspecting the one or more packets for data patterns;
identifying a number of transitions that are present in a dynamic finite automation (DFA) state diagram from a current node in the DFA state diagram to one or more subsequent nodes in the DFA state diagram, wherein the DFA state diagram represents one or more sequences of data patterns, each of the current node and one or more subsequent nodes being associated with a DFA state, and each transition of the number of transitions corresponds to a change from one DFA state to another DFA state in the DFA state diagram;
dynamically allocating an array data structure maintained by the current node when the number of transitions that are present between the current node and the each of the one or more subsequent nodes correspond to a single node chain where each of the one or more subsequent nodes is associated with a single child node;
identifying a first pattern;
blocking the one or more packets when the first pattern is detected; and
issuing an alarm when the first pattern is detected.
2. The method of claim 1 , further comprising the processor storing information for each child node.
3. The method of claim 2 , wherein the information for each child node is compressed before it is stored.
4. The method of claim 1 , further comprising the processor dynamically allocating a data structure for each of the subsequent nodes for storing information associated with each of the subsequent nodes in memory, wherein data structures for the subsequent nodes are dynamically allocated in an array data structure to optimize performance when the number of transitions is greater than a predetermined threshold, and wherein data structures for the subsequent nodes are dynamically allocated in a linked-list data structure to optimize memory utilization when the number of transitions is less than or equal to the predetermined threshold.
5. The method of claim 1 , further comprising:
the processor identifying a plurality of patterns, wherein the plurality of patterns include the first pattern;
the processor blocking the one or more packets when the plurality of patterns are
detected; and
the processor issuing an alarm when the plurality of patterns are detected.
6. The method of claim 5 , wherein:
the plurality of patterns form a signature,
an earlier pattern precedes a subsequent pattern in the signature, and
the processor continues looking for the earlier pattern after the processor has identified the earlier pattern while the processor is looking for the subsequent pattern.
7. The method of claim 5 , wherein:
the plurality of patterns form a signature,
an earlier pattern precedes a subsequent pattern in the signature, and
the earlier pattern must be separated from the subsequent pattern by a predetermined number of bytes or more for the subsequent pattern to be identified as a portion of the signature.
8. The method of claim 5 , wherein:
the plurality of patterns form a signature,
an earlier pattern precedes a subsequent pattern in the signature, and
the earlier pattern must be separated from the subsequent pattern by a predetermined number of bytes or less for the subsequent pattern to be identified as a portion of the signature.
9. A non-transitory computer storage medium having embodied thereon a program executable by a processor to perform a method for data pattern analysis of one or more packets, the method comprising:
inspecting the one or more packets for data patterns;
identifying a number of transitions that are present in a dynamic finite automation (DFA) state diagram from a current node in the DFA state diagram to one or more subsequent nodes in the DFA state diagram, wherein the DFA state diagram represents one or more sequences of data patterns, each of the current node and one or more subsequent nodes being associated with a DFA state, and each transition of the number of transitions corresponds to a change from one DFA state to another DFA state in the DFA state diagram;
dynamically allocating an array data structure maintained by the current node when the number of transitions that are present between the current node and the each of the one or more subsequent nodes correspond to a single node chain where each of the one or more subsequent nodes is associated with a single child node;
identifying a first pattern;
blocking the one or more packets when the first pattern is detected; and
issuing an alarm when the first pattern is detected.
10. The non-transitory computer readable storage medium method of claim 9 , further comprising the processor storing information for each child node.
11. The non-transitory computer readable storage medium method of claim 10 , wherein the information for each child node is compressed before it is stored.
12. The non-transitory computer readable storage medium method of claim 9 , the program further executable to dynamically allocate a data structure for each of the subsequent nodes for storing information associated with each of the subsequent nodes in memory, wherein data structures for the subsequent nodes are dynamically allocated in an array data structure to optimize performance when the number of transitions is greater than a predetermined threshold, and wherein data structures for the subsequent nodes are dynamically allocated in a linked-list data structure to optimize memory utilization when the number of transitions is less than or equal to the predetermined threshold.
13. The non-transitory computer readable storage medium method of claim 9 , the program further executable to:
identify a plurality of patterns;
block the one or more packets when the plurality of patterns are detected; and
issue an alarm when the plurality of patterns are detected.
14. The non-transitory computer readable storage medium method of claim 13 , wherein:
the plurality of patterns form a signature, an earlier pattern precedes a subsequent pattern in the signature, and
the processor continues looking for the earlier pattern after the processor has identified the earlier pattern while the processor is looking for the subsequent pattern.
15. The non-transitory computer readable storage medium method of claim 13 , wherein: the plurality of patterns form a signature,
an earlier pattern precedes a subsequent pattern in the signature, and
the earlier pattern must be separated from the subsequent pattern by a predetermined number of bytes or more for the subsequent pattern to be identified as a portion of the signature.
16. The non-transitory computer readable storage medium method of claim 13 , wherein:
the plurality of patterns form a signature,
an earlier pattern precedes a subsequent pattern in the signature, and
the earlier pattern must be separated from the subsequent pattern by a predetermined number of bytes or less for the subsequent pattern to be identified as a portion of the signature.