# US 10,484,420 B2 · Retrieving network packets corresponding to detected abnormal application activity > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,420 B2 - Document ID: US10484420B2 - Status: Granted - Kind: B2 - Application number: 15/811,888 - Filed: 2017-11-14 - Published: 2019-04-04 - Granted: 2019-11-19 - Earliest claimed: 2017-10-03 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Kuo-Chun Chen; Chih-Hung Chou; Wei-Hsiang Hsiung; Sheng-Tung Hsu - Web page: https://patentgrep.com/patent/US10484420B2 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/554: {involving event detection and direct action} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1458: {Denial of Service} - G06F 2221/034: Test or assess a computer or a system - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for preventing abnormal application activity is provided. Packets are retrieved from a packet buffer using packet location information corresponding to information associated with the abnormal application activity in a data processing system. The packets are analyzed to identify content of the network packets causing the abnormal application activity. Network packets containing the content causing the abnormal application activity in the data processing system are blocked. ## Claims ### Claim 1 A computer-implemented method for preventing abnormal application activity associated with a software application running on a data processing system, the computer-implemented method comprising: retrieving, by the data processing system, packets from a packet buffer in response to detecting the abnormal application activity using packet location information corresponding to information associated with the detected abnormal application activity running on the data processing system, wherein the packet location information is used to map a relationship between a received packet and the software application associated with the detected abnormal activity causing security violation; analyzing, by the data processing system, the packets to identify content of the packets causing the abnormal application activity; and blocking, by the data processing system, network packets containing the content causing the abnormal application activity in the data processing system. ### Claim 2 (depends on 1) The computer-implemented method of claim 1 further comprising: detecting, by the data processing system, the abnormal application activity in the data processing system; determining, by the data processing system, the information associated with the abnormal application activity; and querying, by the data processing system, a packet location and data table for the packet location information based on the information associated with the abnormal application activity. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, further comprising: using the packet location and data table to map a relationship between the packets and an application executing on the data processing system that processes the packets. ### Claim 4 (depends on 2) The computer-implemented method of claim 2, wherein the packet location and data table includes packet location information and packet information, wherein the packet location information represents location information for each network packet received by the data processing system and the packet information includes packet content and an application identifier for an application executing on the data processing system that processes the each network packet received by the data processing system. ### Claim 5 (depends on 2) The computer-implemented method of claim 2, further comprising: use the packet location and data table to map a relationship between the packets and an application executing on the data processing system that processes the packets. ### Claim 6 (depends on 2) The computer-implemented method of claim 2, wherein the packet location and data table includes packet location information and packet information, wherein the packet location information represents location information for each network packet received by the data processing system and the packet information includes packet content and an application identifier for an application executing on the data processing system that processes the each network packet received by the data processing system. ### Claim 7 (depends on 1) The computer-implemented method of claim 1 further comprising: storing, by the data processing system, the packets retrieved from the packet buffer and the content causing the abnormal application activity in a file; and outputting, by the data processing system, the file including the packets retrieved from the packet buffer and the content causing the abnormal application activity to a user of the data processing system for further analysis to determine data leaks and vulnerabilities. ### Claim 8 (depends on 1) The computer-implemented method of claim 1 further comprising: receiving, by the data processing system, a packet via a network; and parsing, by the data processing system, the packet to identify information corresponding to the packet. ### Claim 9 (depends on 8) The computer-implemented method of claim 8 further comprising: storing, by the data processing system, the packet in the packet buffer; and identifying, by the data processing system, location information corresponding to the packet stored in the packet buffer. ### Claim 10 (depends on 9) The computer-implemented method of claim 9 further comprising: recording, by the data processing system, the location information corresponding to the packet stored in the packet buffer in a packet location and data table; and storing, by the data processing system, the information corresponding to the packet with the location information recorded in the packet location and data table. ### Claim 11 (depends on 1) The computer-implemented method of claim 1, wherein the packet buffer is located in an operating system kernel of the data processing system. ### Claim 12 (depends on 1) The computer-implemented method of claim 1, wherein the packet buffer is located in a network interface card of the data processing system. ### Claim 13 (depends on 1) The computer-implemented method of claim 1, wherein the information associated with the abnormal application activity includes an identifier of an application processing the packets corresponding to the abnormal application activity. ### Claim 14 (depends on 1) The computer-implemented method of claim 1, wherein the packet location information corresponding to the packets causing the abnormal application activity is a buffer address in the packet buffer of each packet causing the abnormal application activity. ### Claim 15 (depends on 1) The computer-implemented method of claim 1, wherein the abnormal application activity is at least one of an access control violation by an application processing the packets, a memory access violation by the application, an occurrence of a network security event caused by application, and a crash of the application. ### Claim 16 (depends on 1) The computer-implemented method of claim 1, wherein the abnormal application activity is abnormal activity of an application executing on the data processing system. ### Claim 17 (depends on 16) The computer-implemented method of claim 16, wherein the abnormal application activity comprises at least one of an access control violation by the application, a memory access violation by the application, an occurrence of a network security event caused by the application, and a crash of the application. ### Claim 18 (depends on 1) The computer-implemented method of claim 1 further comprising: receive a packet via a network; and parse the packet to identify information corresponding to the packet. ### Claim 19 (depends on 18) The computer-implemented method of claim 18 further comprising: store the packet in the packet buffer; and identify location information corresponding to the packet stored in the packet buffer. ### Claim 20 (depends on 1) The computer-implemented method of claim 1 further comprising: record the location information corresponding to the packet stored in the packet buffer in a packet location and data table; and store the information corresponding to the packet with the location information recorded in the packet location and data table. ### Claim 21 (depends on 1) The computer-implemented method of claim 1, wherein the abnormal application activity is abnormal activity of an application executing on the data processing system. ### Claim 22 (depends on 21) The computer-implemented method of claim 21, wherein the abnormal application activity comprises at least one of an access control violation by the application, a memory access violation by the application, an occurrence of a network security event caused by the application, and a crash of the application.