Abstract
A Uniform Resource Identifier (URI) does not in itself pose a security threat. However, as URIs are often used as a compact set of instructions to access the objects over the network, it is possible that an URI contains unintended object or data access. A detection engine providing pattern matching has to be employed to inspect the URI for avoiding malicious access. After pattern matching, if there is no policy matched, the packet will be forwarded; otherwise, it will be blocked by the detection engine. General methods which handle HTTP URI pattern matching are to queue the whole URI content, decode it, literally normalize it and then send the normalized content to pattern matching process. This thesis proposes an automata-based scheme for URI inspection, which combines URI normalization with URI pattern matching by using an improved Aho Corasick efficient string matching algorithm. The received packets will be queued for decoding, and then according to the plain text of URI, they will be sent to the engine for normalizing and pattern matching simultaneously. Only the necessary part of the URI content is queued for decoding instead of queuing the whole URI. The proposed scheme not only accelerates the HTTP normalization, but also reduces the required amount of memory. The performance could increase about 18% under several testing environments. According to the testing result, we could understand that the proposed scheme efficiently improves the performance of the URI inspection.