# US 11,310,142 B1 · Systems and methods for detecting network attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,142 B1 - Document ID: US11310142B1 - Status: Granted - Kind: B1 - Application number: 17/239,324 - Filed: 2021-04-23 - Granted: 2022-04-19 - Earliest claimed: 2021-04-23 - Assignees: Trend Micro Incorporated - Applicants: Trend Micro Incorporated - Inventors: Kevin G. Boyce; Troy W. Tuttle - Web page: https://patentgrep.com/patent/US11310142B1 ## CPC - H04L 43/18: Protocol analysers - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 43/028: by filtering - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/123: {received data contents, e.g. message integrity} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding - H04L 69/04: Protocols for data compression, e.g. ROHC - H04L 69/18: Multiprotocol handlers, e.g. single devices capable of handling multiple protocols - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Network attacks are detected by a protocol engine that works in conjunction with one or more streaming protocol analyzers. The protocol engine receives network packets over a computer network and generates metadata of the network packets. The metadata are placed in a transport envelope, which is streamed over the computer network. The transport envelope is received over the computer network. After receiving the transport envelope over the computer network, the metadata are extracted from the transport envelope and provided to the one or more streaming protocol analyzers, which analyze the metadata to detect network attacks. ## Claims ### Claim 1 A method of detecting network attacks, the method comprising: receiving network packets over a computer network; after receiving the network packets over the computer network, generating metadata of the network packets from information extracted from the network packets; placing the metadata in a transport envelope; streaming the transport envelope over the computer network; receiving the transport envelope over the computer network; after receiving the transport envelope over the computer network, extracting the metadata from the transport envelope; and after extracting the metadata from the transport envelope, analyzing the metadata to detect a network attack, wherein analyzing the metadata to detect a network attack comprises distributing the metadata into at least one of a plurality of shards and providing the metadata to a streaming protocol analyzer that is subscribed to receive the metadata from a shard of the plurality of shards. ### Claim 2 (depends on 1) The method of claim 1, wherein the metadata indicate a source of the transport envelope. ### Claim 3 (depends on 1) The method of claim 1, wherein the metadata indicate flow information of the network packets. ### Claim 4 (depends on 1) The method of claim 1, wherein the metadata indicate application-layer metadata of the network packets. ### Claim 5 (depends on 4) The method of claim 4, wherein the application-layer metadata of the network packets indicate a Hypertext Transfer Protocol (HTTP) method. ### Claim 6 A system for detecting network attacks, the system comprising: a host computing device comprising a processor and a memory that stores a protocol engine, the protocol engine comprising instructions that when executed by the processor of the host computing device cause the host computing device to: receive network packets over a computer network; after the network packets have been received over the computer network, generate metadata of the network packets from information extracted from the network packets; place the metadata in a transport envelope; and stream the transport envelope over the computer network; and a backend system comprising at least one processor and a memory, the memory of the backend system storing instructions that when executed by the at least one processor of the backend system cause the backend system to: receive the transport envelope over the computer network; extract the metadata from the transport envelope; and analyze the metadata to detect a network attack, wherein the instructions stored in the memory of the backend system, when executed by the at least one processor of the backend system, cause the backend system to: distribute the metadata into at least one of a plurality of shards; and provide the metadata to a streaming protocol analyzer that is subscribed to receive the metadata from a shard of the plurality of shards. ### Claim 7 (depends on 6) The system of claim 6, wherein the metadata indicate a source of the transport envelope. ### Claim 8 (depends on 6) The system of claim 6, wherein the metadata indicate flow information of the network packets. ### Claim 9 (depends on 6) The system of claim 6, wherein the metadata indicate application-layer metadata of the network packets. ### Claim 10 (depends on 9) The system of claim 9, wherein the application-layer metadata of the network packets indicate a Hypertext Transfer Protocol (HTTP) method. ### Claim 11 A method of detecting network attacks, the method comprising: receiving network packets over a computer network; after receiving the network packets over the computer network, generating metadata of the network packets from information extracted from the network packets; encoding the metadata; compressing the encoded metadata; placing the compressed metadata in a transport envelope; marking the transport envelope with a shard key; streaming the transport envelope over the computer network; receiving the transport envelope over the computer network; after receiving the transport envelope over the computer network, extracting the metadata from the transport envelope; and after extracting the metadata from the transport envelope, analyzing the metadata to detect a network attack. ### Claim 12 (depends on 11) The method of claim 11, wherein analyzing the metadata to detect a network attack comprises: distributing the metadata into at least one of a plurality of shards according to the shard key; and providing the metadata to a streaming protocol analyzer that is subscribed to receive the metadata from a shard of the plurality of shards. ### Claim 13 (depends on 11) The method of claim 11, wherein the metadata indicate a source of the transport envelope. ### Claim 14 (depends on 11) The method of claim 11, wherein the metadata indicate flow information of the network packets. ### Claim 15 (depends on 11) The method of claim 11, wherein the metadata indicate application-layer metadata of the network packets. ### Claim 16 (depends on 15) The method of claim 15, wherein the application-layer metadata of the network packets indicate a Hypertext Transfer Protocol (HTTP) method. ### Claim 17 A system for detecting network attacks, the system comprising: a host computing device comprising a processor and a memory that stores a protocol engine, the protocol engine comprising instructions that when executed by the processor of the host computing device cause the host computing device to: receive network packets over a computer network; after the network packets have been received over the computer network, generate metadata of the network packets from information extracted from the network packets; place the metadata in a transport envelope; and stream the transport envelope over the computer network; and a backend system comprising at least one processor and a memory, the memory of the backend system storing instructions that when executed by the at least one processor of the backend system cause the backend system to: receive the transport envelope over the computer network; extract the metadata from the transport envelope; and analyze the metadata to detect a network attack, wherein the instructions stored in the memory of the host computing device, when executed by the processor of the host computing device, cause the host computing device to: encode the metadata; compress the encoded metadata; place the compressed metadata in the transport envelope; mark the transport envelope with a shard key; and stream the transport envelope to the backend system over the computer network. ### Claim 18 (depends on 17) The system of claim 17, wherein the instructions stored in the memory of the backend system, when executed by the at least one processor of the backend system, cause the backend system to: distribute the metadata into at least one of a plurality of shards according to the shard key; and provide the metadata to a streaming protocol analyzer that is subscribed to receive the metadata from a shard of the plurality of shards. ### Claim 19 (depends on 17) The system of claim 17, wherein the metadata indicate a source of the transport envelope. ### Claim 20 (depends on 17) The system of claim 17, wherein the metadata indicate flow information of the network packets. ### Claim 21 (depends on 17) The system of claim 17, wherein the metadata indicate application-layer metadata of the network packets. ### Claim 22 (depends on 21) The system of claim 21, wherein the application-layer metadata of the network packets indicate a Hypertext Transfer Protocol (HTTP) method.