SIGNATURE CLUSTERING METHOD BASED GROUPING ATTACK SIGNATURE BY THE HASHING

摘要

PURPOSE: A signature clustering method based on attack signature grouping using bit-vector of hashing results is provided to reduce the time for work through rapid pattern matching using hardware. CONSTITUTION: A prime message is extracted from a packet received(S120). In case the prime message is a first message, overlapping hashing of the prime message is executed(S130,S140). A bit vector table is updated using the hash values(S150). In case the prime message is not the first message, consecutive hashing of the prime message is executed(S170). In case the hash values exist in the bit vector table, the processing result is outputted(S270).