一种基于旋转TCAM的模式匹配算法  

A Pattern Matching Algorithm Based on Rotating TCAM

作　　者：刘仲会 许芳奎 许红光 LIU Zhong-hui;XU Fang-kui;XU Hong-guang(Tianjing Electric Information College,Tianjin 300350,China;Beijing Institute of Technology,Beijing 100081,China)

机构地区：[1]天津电子信息职业技术学院,天津300350 [2]北京理工大学,北京100081

出　　处：《火力与指挥控制》2020年第1期59-64,共6页Fire Control & Command Control

基　　金：中国教师发展基金会“十三五”规划重点基金资助项目（CTDF-KT1605103）

摘　　要：为了实现对网络入侵恶意流量的有效检测,提出了一种基于旋转TCAM的模式匹配算法。算法具体实现分为2个阶段,在第1阶段,将规则签名(模式)进行划分,以适合所选择的长度为w的前缀滑动窗口;在第2阶段,通过将前缀向右移,丢弃最右端的字符并在左边添加“don’t care”,直至全部模式的字节都是“don’t care”,从而提供默认的匹配行,实现对全部输入流量的匹配和对入侵主体的有效检测。仿真结果表明,提出的模式匹配算法不仅能够以线速运行在单一的操作中匹配多个模式,而且相比于其他基于TCAM的模式匹配算法,有更好的内存访问和TCAM查找访问性能。In order to effectively detect the malicious traffic of network intrusion,a pattern matching algorithm based on rotating TCAM is proposed.The concrete implementation of the algorithm is divided into two phases.In the first phase,the rule's signatures(patterns)are split to fit in the chosen prefix sliding window whose length is w.In the second phase,by shifting the prefix to the right and losing the rightmost character and adding"don't care"at the left,until all of the pattern's bytes are"don't care",the default matching rows are provided to match all the input traffic and detect the intrusion subject effectively.The simulation results show that the proposed pattern matching algorithm can not only match multiple patterns in a single operation with line-rate speed,but also has better performances in terms of memory access and TCAM access lookup,compared with other pattern matching algorithm based on TCAM.

关 键 词：网络入侵 检测 Snort规则语法 模式匹配 三态内容寻址存储器 内存访问 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]