String pattern matching for multi-string pattern rules in intrusion detection
In some embodiments, a method stores a plurality of identifiers for a plurality of rules. The plurality of rules each include a set of patterns, and a rule and a pattern combination is associated with an identifier in the plurality of identifiers. Information being sent on a network is scanned and the method determines when a pattern in the information matches a pattern for a rule. The method identifies an identifier for the pattern where the identifier identifies a rule and a pattern combination. Then, the method identifies the rule and the pattern combination based on the identifier. The set of patterns for the rule is found in the information based on determining that the rule and the pattern combinations for the rule have been found in the information.
1. A method of performing intrusion detection on a host computer, the method comprising:
at an intrusion detector executing on the host computer:
performing a scan of a payload of a packet associated with a workload machine executing on the host computer to identify one or more patterns;
for each identified pattern, identifying each intrusion detection rule that is associated with the identified pattern;
determining that the patterns stored in the payload match all of the patterns associated with a particular intrusion detection rule; and
performing, on the packet, an action specified by the particular intrusion detection rule.
2. The method of claim 1 , wherein performing the scan comprises performing a single scan of characters in the payload.
3. The method of claim 2 , wherein the characters are string characters stored in the payload, and the identified patterns are identified string patterns stored in the payload.
4. The method of claim 2 , wherein identifying each rule that is associated with each identified pattern allows the intrusion detector to perform only a single scan of the payload.
5. The method of claim 1 further comprising storing, for each pattern, an identifier that includes a first portion of information that identifies the rule and a second portion of information that identifies the pattern.
6. The method of claim 1 further comprising:
for each identified pattern for which a rule is identified, storing an indicator that identifies the pattern of the rule as being included in the payload; and
wherein said determining comprises determining when all indicators for all patterns of the particular rule have been stored.
7. The method of claim 1 , wherein performing the scan comprises iteratively identifying different patterns in the payload.
8. The method of claim 7 , wherein identifying each rule for each identified pattern comprises:
examining all the rules for each identified pattern after the pattern has been identified; and
after all the rules have been examined, continuing to scan the information to determine another pattern that is found in the information until the set of patterns for the rule is found in the information.
9. The method of claim 1 , wherein the workload machines comprise virtual machines or containers.
10. The method of claim 1 , wherein the intrusion detector is a service provided by a hypervisor executing on the host computer.
11. A non-transitory machine-readable medium storing an intrusion detector program which when executed by at least one processing unit performs intrusion detection on a host computer, the program comprising sets of instructions for:
performing a scan of a payload of a packet associated with a workload machine executing on the host computer to identify one or more patterns;
for each identified pattern, identifying each intrusion detection rule that is associated with the identified pattern;
determining that the patterns stored in the payload match all of the patterns associated with a particular intrusion detection rule; and
performing, on the packet, an action specified by the particular intrusion detection rule.
12. The non-transitory machine-readable medium of claim 11 , wherein the set of instructions for performing the scan comprises a set of instructions for performing a single scan of characters in the payload.
13. The non-transitory machine-readable medium of claim 12 , wherein the characters are string characters stored in the payload, and the identified patterns are identified string patterns stored in the payload.
14. The non-transitory machine-readable medium of claim 12 , wherein the set of instructions for identifying each rule that is associated with each identified pattern allows the intrusion detector to perform only a single scan of the payload.
15. The non-transitory machine-readable medium of claim 11 , the program further comprising a set of instructions for storing, for each pattern, an identifier that includes a first portion of information that identifies the rule and a second portion of information that identifies the pattern.
16. The non-transitory machine-readable medium of claim 11 , the program further comprising sets of instructions for:
for each identified pattern for which a rule is identified, storing an indicator that identifies the pattern of the rule as being included in the payload; and
wherein the set of instructions for determining comprises a set of instructions for determining when all indicators for all patterns of the particular rule have been stored.
17. The non-transitory machine-readable medium of claim 11 , wherein the set of instructions for performing the scan comprises a set of instructions for iteratively identifying different patterns in the payload.
18. The non-transitory machine-readable medium of claim 17 , wherein the set of instructions for identifying each rule for each identified pattern comprises sets of instructions for:
examining all the rules for each identified pattern after the pattern has been identified; and
after all the rules have been examined, continuing to scan the information to determine another pattern that is found in the information until the set of patterns for the rule is found in the information.
19. The non-transitory machine-readable medium of claim 11 , wherein the workload machines comprise virtual machines or containers.
20. The non-transitory machine-readable medium of claim 11 , wherein the intrusion detector is a service provided by a hypervisor executing on the host computer.