Back to results
US 11,310,142 B1Granted
Systems and methods for detecting network attacks
AssigneeTrend Micro Incorporated
InventorsKevin G. Boyce, Troy W. Tuttle
Life of this patent
Estimating the term…
Abstract
Network attacks are detected by a protocol engine that works in conjunction with one or more streaming protocol analyzers. The protocol engine receives network packets over a computer network and generates metadata of the network packets. The metadata are placed in a transport envelope, which is streamed over the computer network. The transport envelope is received over the computer network. After receiving the transport envelope over the computer network, the metadata are extracted from the transport envelope and provided to the one or more streaming protocol analyzers, which analyze the metadata to detect network attacks.
Claims22
A method of detecting network attacks, the method comprising:
- receiving network packets over a computer network;
- after receiving the network packets over the computer network, generating metadata of the network packets from information extracted from the network packets;
- placing the metadata in a transport envelope;
- streaming the transport envelope over the computer network;
- receiving the transport envelope over the computer network;
- after receiving the transport envelope over the computer network, extracting the metadata from the transport envelope;
- and
- after extracting the metadata from the transport envelope, analyzing the metadata to detect a network attack,
- wherein analyzing the metadata to detect a network attack comprises distributing the metadata into at least one of a plurality of shards and providing the metadata to a streaming protocol analyzer that is subscribed to receive the metadata from a shard of the plurality of shards.
6 more elements
A system for detecting network attacks, the system comprising:
- a host computing device comprising a processor and a memory that stores a protocol engine, the protocol engine comprising instructions that when executed by the processor of the host computing device cause the host computing device to:
- receive network packets over a computer network;
- after the network packets have been received over the computer network, generate metadata of the network packets from information extracted from the network packets;
- place the metadata in a transport envelope;
- and
- stream the transport envelope over the computer network;
- and
- a backend system comprising at least one processor and a memory, the memory of the backend system storing instructions that when executed by the at least one processor of the backend system cause the backend system to:
- receive the transport envelope over the computer network;
- extract the metadata from the transport envelope;
- and
- analyze the metadata to detect a network attack,
- wherein the instructions stored in the memory of the backend system, when executed by the at least one processor of the backend system, cause the backend system to:
- distribute the metadata into at least one of a plurality of shards;
- and provide the metadata to a streaming protocol analyzer that is subscribed to receive the metadata from a shard of the plurality of shards.
12 more elements
A method of detecting network attacks, the method comprising:
- receiving network packets over a computer network;
- after receiving the network packets over the computer network, generating metadata of the network packets from information extracted from the network packets;
- encoding the metadata;
- compressing the encoded metadata;
- placing the compressed metadata in a transport envelope;
- marking the transport envelope with a shard key;
- streaming the transport envelope over the computer network;
- receiving the transport envelope over the computer network;
- after receiving the transport envelope over the computer network, extracting the metadata from the transport envelope;
- and
- after extracting the metadata from the transport envelope, analyzing the metadata to detect a network attack.
8 more elements
A system for detecting network attacks, the system comprising:
- a host computing device comprising a processor and a memory that stores a protocol engine, the protocol engine comprising instructions that when executed by the processor of the host computing device cause the host computing device to:
- receive network packets over a computer network;
- after the network packets have been received over the computer network, generate metadata of the network packets from information extracted from the network packets;
- place the metadata in a transport envelope;
- and
- stream the transport envelope over the computer network;
- and
- a backend system comprising at least one processor and a memory, the memory of the backend system storing instructions that when executed by the at least one processor of the backend system cause the backend system to:
- receive the transport envelope over the computer network;
- extract the metadata from the transport envelope;
- and
- analyze the metadata to detect a network attack,
- wherein the instructions stored in the memory of the host computing device, when executed by the processor of the host computing device, cause the host computing device to:
- encode the metadata;
- compress the encoded metadata;
- place the compressed metadata in the transport envelope;
- mark the transport envelope with a shard key;
- and
- stream the transport envelope to the backend system over the computer network.
16 more elements
Dependencies are inferred from the claim text.