Reassembly free deep packet inspection for peer to peer networks
AssigneeSonicWALL, Inc.
InventorsHui Ling, Cuiping Yu, Zhong Chen
Life of this patent
Estimating the term…
Abstract
The present disclosure relates to a system, a method, and a non-transitory computer readable storage medium for deep packet inspection scanning at an application layer of a computer. A method of the presently claimed invention may scan pieces of data received out of order without reassembly at an application layer from a first input state generating one or more output states for each piece of data. The method may then identify that the first input state includes one or more characters that are associated with malicious content. The method may then identify that the data set may include malicious content when the first input state combined with one or more output states matches a known piece of malicious content.
Claims20
A method for scanning computer data, the method comprising:
- scanning a first out-of-order portion of a dataset from an input state associated with malware, wherein the first out-of-order portion is sent to a destination after the scanning;
- generating a pattern that identifies the malware as a result of the scanning the first out-of-order portion;
- generating an output state by scanning a second out-of-order portion of the dataset that immediately precedes the first out-of-order portion of the dataset;
- identifying that the dataset includes a set of malware based on matching of the input and output state;
- and
- blocking the second out-of-order portion of the dataset from being sent to the destination based on the identification that the dataset includes the set of malware.
A method for identifying malicious program code, the method comprising:
- storing a state mapping in memory, wherein the state mapping associates a first group of characters with a first state and a second group of characters with a second state;
- identifying that a first portion of a dataset includes the second group of characters based on scanning the first portion of a dataset from the first state;
- comparing the first state with an output state that is generated when a second portion of the dataset is scanned;
- identifying that the dataset includes a set of malware based on the output state matching the first state;
- and
- blocking data from being sent to a destination based on the identification that the dataset includes the set of malware.
A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for implementing a method for scanning computer data, the method comprising:
- scanning a first out-of-order portion of a dataset from an input state associated with malware, wherein the first out-of-order portion is sent to a destination after the scanning;
- generating a pattern that identifies the malware as a result of the scanning the first out-of-order portion;
- generating an output state by scanning a second out-of-order portion of the dataset that immediately precedes the first out-of-order portion of the dataset;
- identifying that the dataset includes a set of malware based on matching of the input and output state;
- and
- blocking the second out-of-order portion of the dataset from being sent to the destination based on the identification that the dataset includes the set of malware.
Dependencies are inferred from the claim text.