Method and system for classifying a protocol message in a data communication network
AssigneeForescout Technologies, Inc.
InventorEmmanuele Zambon
Life of this patent
Estimating the term…
Abstract
An intrusion detection method for detecting an intrusion in data traffic on a data communication network parses the data traffic to extract at least one protocol field of a protocol message of the data traffic, and associates the extracted protocol field with a model for that protocol field. The model is selected from a set of models. An assessment is made to determine if a contents of the extracted protocol field is in a safe region as defined by the model, and an intrusion detection signal is generated in case it is established that the contents of the extracted protocol field is outside the safe region. The set of models may comprise a corresponding model for each protocol field of a set of protocol fields.
Claims17
A method, comprising:
- parsing data traffic to extract at least one protocol field of a protocol message of the data traffic to generate an extracted protocol field;
- determining whether one or more models of a set of models corresponds to the extracted protocol field;
- in response to determining that a selected model of the set of models corresponds to the extracted protocol field:
- associating the extracted protocol field with the selected model of a set of models for the extracted protocol field;
- assessing whether contents of the extracted protocol field are in a safe region of values for the at least one protocol field as defined by the selected model;
- and
- generating an intrusion detection signal based on whether the contents of the extracted protocol field is outside the safe region of values;
- and
- in response to determining that the extracted protocol field does not correspond to any of the models of the set of models:
- generating the intrusion detection signal.
A system, comprising:
- a processing device to:
- parse data traffic to extract at least one protocol field of a protocol message of the data traffic to generate an extracted protocol field;
- determine whether one or more models of a set of models corresponds to the extracted protocol field;
- in response to determining that a selected model of the set of models corresponds to the extracted protocol field:
- associate the extracted protocol field with the selected model of a set of models for the extracted protocol field;
- assess whether contents of the extracted protocol field are in a safe region of values for the at least one protocol field as defined by the selected model;
- and
- generate an intrusion detection signal based on whether the contents of the extracted protocol field is outside the safe region of values;
- and
- in response to determining that the extracted protocol field does not correspond to any of the models of the set of models:
- generate the intrusion detection signal.
A non-transitory computer readable medium having instructions stored thereon which, when executed by a processing device, causes the processing device to:
- parse data traffic to extract at least one protocol field of a protocol message of the data traffic to generate an extracted protocol field;
- determine whether one or more models of a set of models corresponds to the extracted protocol field;
- in response to determining that a selected model of the set of models corresponds to the extracted protocol field:
- associate the extracted protocol field with a selected model of a set of models for the extracted protocol field;
- assess, by the processing device, whether contents of the extracted protocol field are in a safe region of values for the at least one protocol field as defined by the selected model;
- and
- generate an intrusion detection signal based on whether the contents of the extracted protocol field is outside the safe region of values;
- and
- in response to determining that the extracted protocol field does not correspond to any of the models of the set of models:
- generate the intrusion detection signal.
Dependencies are inferred from the claim text.