Real-time malware detection
AssigneeRedberry Systems, Inc.
InventorsMadhavan Bakthavatchalam, Sandeep Khanna, Varadarajan Srinivasan
Life of this patent
Estimating the term…
Abstract
Upon receiving malware detection rules that are to be identified with respect to an input traffic stream, a rule database that requires less storage capacity than the malware detection rules is generated by substituting tokens for selected symbol strings within the malware detection rules. A compressed traffic stream is generated by substituting the tokens for instances of the selected symbol strings within the input traffic stream, and then compared with the rule database to determine whether the input traffic stream contains one or more symbol sequences that correspond to any of the malware detection rules.
Claims21
A method of operation within a malware detection device, the method comprising:
- receiving malware detection rules that are to be identified with respect to an input traffic stream;
- compressing a subset of the malware detection rules by substituting tokens for selected symbol strings within each of the subset of malware detection rules to produce a compressed rule database in which storage of all information required to detect symbol sequences within the input traffic stream that match any of the subset of malware detection rules is less than would be required for storage of the subset of malware detection rules;
- receiving the input traffic stream and generating a compressed traffic stream therefrom by substituting the tokens for instances of the selected symbol strings within the input traffic stream;
- and
- comparing the compressed traffic stream with the compressed rule database to determine whether the input traffic stream contains one or more symbol sequences that correspond to any of the subset of malware detection rules.
A malware detection device comprising:
- a control interface to receive a plurality of malware detection rules that are to be identified with respect to an input traffic stream;
- a data interface to receive the input traffic stream;
- one or more logic engines coupled to the control and data interfaces to receive the malware detection rules and input traffic stream, respectively, and to (i) compress a subset of the malware detection rules by substituting tokens for selected symbol strings within the subset of malware detection rules to produce a compressed rule database in which storage of all information required to detect symbol sequences within the input traffic stream that match any of the subset of malware detection rules is less than would be required for storage of the subset of malware detection rules, and (ii) generate a compressed traffic stream from the input traffic stream by substituting the tokens for instances of the selected symbol strings within the input traffic stream;
- and
- a rule search memory to (i) receive and store the compressed rule database generated by the one or more logic engines, (ii) receive the compressed traffic stream from the one or more compression engines, and (iii) compare the compressed traffic stream with the compressed rule database to determine whether the input traffic stream contains one or more symbol sequences that correspond to any of the subset of malware detection rules.
A malware detection device comprising:
- means for receiving a plurality of malware detection rules that are to be identified with respect to an input traffic stream;
- means for compressing a subset of the malware detection rules by substituting tokens for selected symbol strings within each of the subset of malware detection rules to produce a compressed rule database in which storage of all information required to detect symbol sequences within the input traffic stream that match any of the subset of malware detection rules is less than would be required for storage of the subset of malware detection rules;
- means for receiving the input traffic stream and generating a compressed traffic stream therefrom by substituting the tokens for instances of the selected symbol strings within the input traffic stream;
- and
- means for comparing the compressed traffic stream with the compressed rule database to determine whether the input traffic stream contains one or more symbol sequences that correspond to any of the subset of malware detection rules.
Dependencies are inferred from the claim text.