A Fast Matching Method of Trusted Whitelist Based on Bloom Filter

Abstract

In the process of whitelist checking in the operating system kernel, the main problem is how to put the relatively large amount of whitelist data information into the relatively limited kernel memory space (because the kernel module generally runs entirely in memory and does not directly access large external memory in order to maintain speed) and how to maintain a relatively fast lookup speed. This paper provides a trusted whitelist fast matching device and method to provide a function for fast trusted whitelist comparison and matching in an operating system kernel module with limited memory and limited time to reduce system lag and less available memory due to the introduction of a trusted metric mechanism. To solve the above technical problems, this paper provides a trusted whitelist fast matching device, which introduces a probabilistic algorithm called “Bloom filter” to reduce the time complexity of whitelist retrieval to a constant order and the space complexity to an order of magnitude lower than the above deterministic algorithm, while combining the features of trusted metrics.