Stream scanner for identifying signature matches

1. A non-transitory computer-readable storage medium having computer readable code stored thereon for programming a processor, in a node of a cloud-based security system, to perform steps of:

obtaining a plurality of rules each defined via a rule syntax that includes a rule header and rule options, wherein each rule header is used to for a rule database lookup, and each rule options is used to specify details about an associated rule;

monitoring data associated with a user of the cloud-based security system, wherein the node does not buffer the data during the monitoring, and wherein the monitoring includes maintaining a stream state across packet boundaries of the data;

analyzing the data with the plurality of rules;

performing one or more security functions on the data based on triggering of a rule of the plurality of rules unless the rule is an experimental rule, wherein the cloud-based security system utilizes the plurality of rules to implement one or more of a firewall and an intrusion prevention system; and

monitoring the data associated with triggering any of experimental rules and processing the data associated with the triggering any of the experimental rules to develop new rules.

2. The non-transitory computer-readable storage medium of claim 1 , wherein the experimental rules are written in a manner that includes false positives, and the processing is to reduce the false positives.

3. The non-transitory computer-readable storage medium of claim 1 , wherein the plurality of rules include a match of a pattern, signature, syntax, or expression.

4. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include

subsequent to a first match of the rule of the plurality of rules, stopping the analyzing and performing the one or more security functions.

5. The non-transitory computer-readable storage medium of claim 1 , wherein one or more rules of the plurality of rules include a fast pattern.

6. A node in a cloud-based security system, comprising:

a processor and memory storing instructions that, when executed, cause the processor to

obtain a plurality of rules each defined via a rule syntax that includes a rule header and rule options, wherein each rule header is used to for a rule database lookup, and each rule options is used to specify details about an associated rule;

monitor data associated with a user of the cloud-based security system, wherein the node does not buffer the data during the monitoring, and wherein the instructions that, when executed, further cause the processor to maintain a stream state across packet boundaries of the data;

analyze the data with the plurality of rules;

perform one or more security functions on the data based on triggering of a rule of the plurality of rules unless the rule is an experimental rule, wherein the cloud-based security system utilizes the plurality of rules to implement one or more of a firewall and an intrusion prevention system; and

monitor the data associated with triggering any of experimental rules and process the data associated with the triggering any of the experimental rules to develop new rules.

7. The node of claim 6 , wherein the plurality of rules include a match of a pattern, signature, syntax, or expression.

8. The node of claim 6 , wherein the instructions that, when executed, further cause the processor to

subsequent to a first match of the rule of the plurality of rules, stopping the analyzing and performing the one or more security functions.

9. The node of claim 6 , wherein one or more rules of the plurality of rules include a fast pattern.

10. A method implemented in a node in a cloud-based security system, the method comprising:

obtaining a plurality of rules each defined via a rule syntax that includes a rule header and rule options, wherein each rule header is used to for a rule database lookup, and each rule options is used to specify details about an associated rule;

monitoring data associated with a user of the cloud-based security system, wherein the node does not buffer the data during the monitoring, and the monitoring includes maintaining a stream state across packet boundaries of the data;

analyzing the data with the plurality of rules;

performing one or more security functions on the data based on triggering of a rule of the plurality of rules unless the rule is an experimental rule, wherein the cloud-based security system utilizes the plurality of rules to implement one or more of a firewall and an intrusion prevention system; and

monitoring the data associated with triggering any of experimental rules and processing the data associated with the triggering any of the experimental rules to develop new rules.

11. The method of claim 10 , further comprising

subsequent to a first match of the rule of the plurality of rules, stopping the analyzing and performing the one or more security functions.

12. The non-transitory computer-readable storage medium of claim 1 , wherein a new rule is converted from an experimental rule to the new rule based on monitoring a number of false positives over time.

13. The non-transitory computer-readable storage medium of claim 1 , wherein the plurality of rules are compliant to a Snort format.

14. The non-transitory computer-readable storage medium of claim 1 , wherein the data is not buffered during the monitoring and the analyzing utilizes a graph to determine rule matching across different packets.