FPGA MATCHING DEVICE OF HIGH SPEED SNORT RULE AND YARA RULE BASED ON FPGA

摘要

The present invention relates to an FPGA-based fast snort rule and Yarra rule matching device, comprising: a detection rule converter for converting a snort rule and a yarra rule into a format for a detection function; And receiving an input packet input from a network based on the rule converted into the format, detecting a fixed pattern in a high speed packet processing module, matching a PCRE pattern in a PCRE detection module, and performing a dynamic hash and match control module. After checking the policy to apply the same file search result through the detection result processing module, the mitigation control signal is read and then read the corresponding input packet stored in the packet FIFO in the mitigation policy application module to apply the detection result application policy. Detection engine for sending in the packet; characterized in that it comprises a.