Patent Document ID: 9258317
Application ID: 13797171
Patent Status: 1

Claim One:
1. A method for network intrusion detection by data matching based on a regular expression set comprising one or more regular expressions, implemented by a processor executing instructions stored on a non-transitory processor readable medium, comprising steps of: searching in the regular expression set for one or more complex regular expressions which cause expansion in the number of states generated based on the regular expression during interaction; constructing a corresponding simplified expression for each of the one or more searched-out complex regular expressions by connecting all character string feature of the searched-out complex regular expression and deleting a character string feature that appears frequently; compiling only one simplified state machine based on the constructed simplified expression and remaining regular expressions in the regular expression set except for the one or more searched-out complex regular expressions; compiling one or more substate machines, wherein each of the one or more substate machines is compiled based on a corresponding one of the one or more complex regular expressions; obtaining network data; and matching the obtained network data based on the simplified state machine and the one or more substate machines to judge whether the network data is network intrusion data.