Patent Document ID: 7913304
Application ID: 11753716

Base Claim:
1. An event detection method, comprising: predefining event-based detection rules with a predicative context-free grammar, wherein the predicative context-free grammar G is a quintuple in a form of G={V N , V T , S, R, P}, in which: V T is a terminal symbol set, comprising terminal symbols v t ; V N is a non-terminal symbol set, comprising non-terminal symbols v n ; V T and V N are collectively referred to as a symbol set V in which an item is referred to as a symbol v; S is a target grammar symbol, with SεV N ; R is a production set of the grammar; and P is a predicate set of the grammar, and wherein the production is in a form of v n : v 1 (p 1 ), . . . , v k (p k ), in which on a left-hand side of the production is a non-terminal symbol v n εV N ; on a right-hand side of the production comprises zero or more predicative terminal symbols or predicative non-terminal symbols v 1 , . . . , v k εV; predicates p 1 , . . . , p k εP are constraints that are to be met by the symbols on the right-hand side of the production and consist of a combination of logical operators, arithmetic operators and function calls; and semantics of the production is that the symbol on the left-hand side of the production is resolved from the predicative symbols on the right-hand side of the production; generating through a generation module, by parsing the detection rules, a parsing table of pushdown automaton which supports parallel parsing, wherein the parsing table of pushdown automaton is obtained through the steps of: a) parsing protocol rules and attack rules to obtain a syntax tree; b) generating item sets of the predicative context-free grammar with a predicative LR(0) generation algorithm; and c) converting the item sets to obtain a corresponding parsing table of pushdown automaton which comprises an ACTION table and a GOTO table; receiving through an interface unit an event to be detected; and analyzing by a controller the event to be detected according to the parsing table, to obtain a detection result.

---

Claim 2:
2. The method according to claim 1 , wherein the detection rules comprise protocol rules and attack rules when the method is applied to network intrusion detection field.