公开(公告)号：US20240184578A1

公开(公告)日：2024-06-06

申请号：US18440818

申请日：2024-02-13

Applicant: Intel Corporation

Inventor： Hao CHANG ,  Geoffrey LANGDALE ,  Xiang WANG ,  Yang HONG ,  Wenjun ZHU ,  Kun QIU ,  Xusheng LU

IPC: G06F9/30 ,  G06F9/38 ,  G06F15/80

CPC classification number: G06F9/30038 ,  G06F9/30032 ,  G06F9/30043 ,  G06F9/3887 ,  G06F15/8084

Abstract: Methods and embodiments of a high-performance parallel multi-literal matching algorithm called NeoHarry. A chunk of data comprising a character string comprising n bytes is sampled for a byte stream, and data in the sampled chunk are pre-shifted to create shifted copies of data at multiple sampled locations. A mask table is generated having column vectors containing match indicia identifying potential character matches. A look up of the mask table at multiple sampled locations using the pre-shifted data is performed for a target literal character pattern. The mask table lookup results are combined to generate match candidates and exact match verification is performed to identify any generated match candidates that match the target literal character pattern. NeoHarry uses a column-vector-based shift-or model and implements a cross-domain shift algorithm under which character patterns spanning two domains are identified.

公开(公告)号：US20220113969A1

公开(公告)日：2022-04-14

申请号：US17559752

申请日：2021-12-22

Applicant: Intel Corporation

Inventor： Hao CHANG ,  Xiang WANG ,  Yang HONG ,  Wenjun ZHU ,  Kun QIU ,  Baoqian LI

IPC: G06F9/30 ,  G06F9/38

Abstract: Examples include techniques four use of a large scale multi-literal matching algorithm. Implementation of the large scale multi-literal matching algorithm includes processing a chunk of input data via performance of a SHIFT-OR operation using the chunk of input data to identify a match candidate for a target literal character pattern. A single input multiple data (SIMD) instruction may be utilized by a processor to perform the SHIFT-OR operation as a parallel table lookup of rows of SHIFT-OR mask table for the chunk of input data to facilitate identification of the match candidate.

公开(公告)号：US20220279013A1

公开(公告)日：2022-09-01

申请号：US17744463

申请日：2022-05-13

Applicant: Intel Corporation

Inventor： Kun QIU ,  Hao CHANG ,  Ying WANG ,  Wenjun ZHU ,  Xiahui YU ,  Yingqi LIU ,  Baoqian LI ,  Weigang LI

IPC: H04L9/40 ,  G06F16/242 ,  G06F16/903 ,  H04L9/32

Abstract: Methods and apparatus for a flexible Deterministic Finite Automata (DFA) tokenizer for AI-based malicious traffic detection. A DFA compiler is used to process profiles, such as SQLi, HTML5 and XSS profiles, as well as user-defined profiles, to generate corresponding DFA transition tables. The DFA tokenizer includes a DFA engine that employs the DFA transition table(s) to generate token sequences derived from input strings. The token sequences are converted into feature vectors using a feature extraction engine, and the feature vectors are used for training a machine learning/Artificial Intelligence (AI) model configured to perform binary classification (benign or malicious). During run-time, strings are extracted from input received via a network and tokenized with the DFA tokenizer to generate token sequences that are converted into feature vectors. The feature vectors are then classified using the AI model to determine whether the input is benign or malicious.

公开(公告)号：US20220171628A1

公开(公告)日：2022-06-02

申请号：US17559696

申请日：2022-02-17

Applicant: Intel Corporation

Inventor： Yang HONG ,  Hao CHANG ,  Xiang WANG ,  Wenjun ZHU ,  Kun QIU

IPC: G06F9/38

Abstract: Examples include techniques to encode and decode for character class matching. A character class including a plurality of characters may be encoded in a mask table. A sampled chunk of input data is used to perform a decode operation to check, in a parallel manner, each character included in the input data with the encoded mask table. The checking of each character in the input data to determine whether at least one character in the input data matches a character included in the character class.