Reassembly free deep packet inspection for peer to peer networks
AssigneeSonicwall US Holdings Inc.
InventorsHui Ling, Cuiping Yu, Zhong Chen
Life of this patent
Estimating the term…
Abstract
The present disclosure relates to a system, a method, and a non-transitory computer readable storage medium for deep packet inspection scanning at an application layer of a computer. A method of the presently claimed invention may scan pieces of data received out of order without reassembly at an application layer from a first input state generating one or more output states for each piece of data. The method may then identify that the first input state includes one or more characters that are associated with malicious content. The method may then identify that the data set may include malicious content when the first input state combined with one or more output states matches a known piece of malicious content.
Claims20
A method for scanning computer data, the method comprising:
- scanning a first out-of-order block of a dataset at an application layer in a peer-to-peer network, wherein the first out-of-order block is scanned for one or more sets of malware;
- generating an output state based on the scan of the first out-of-order block;
- performing one or more subsequent scans of other blocks of the dataset including a second out-of-order block that precedes the first out-of-order block;
- generating output states for each of the subsequent scans;
- storing in memory the output states for the first out-of-order block and the output states for the other blocks, wherein the output states are correlated to identified input states, wherein the output state for the first out-of-order block reduces a number of the identified input states used when scanning the second out-of-order block;
- and
- identifying that the dataset includes a set of malware when the output states for the first out-of-order block and the output states for the other blocks match a pattern associated with the identified set of malware.
A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor to implement a method for scanning computer data, the method comprising:
- scanning a first out-of-order block of a dataset at an application layer in a peer-to-peer network, wherein the first out-of-order block is scanned for one or more sets of malware;
- generating an output state based on the scan of the first out-of-order block;
- performing one or more subsequent scans of other blocks of the dataset including a second out-of-order block that precedes the first out-of-order block;
- generating output states for each of the subsequent scans;
- storing in memory the output states for the first out-of-order block and the output states for the other blocks, wherein the output states are correlated to identified input states, wherein the output state for the first out-of-order block reduces a number of the identified input states used when scanning the second out-of-order block;
- and
- identifying that the dataset includes a set of malware when the output states for the first out-of-order block and the output states for the other blocks match a pattern associated with the identified set of malware.
A system for scanning computer data, the system comprising:
- a communication interface that communicates over a communication network with one or more computers in a peer-to-peer network, wherein the communication interface receives a plurality of blocks of a dataset;
- a processor that executes instructions stored in memory, wherein the processor executes the instructions to:
- scan a first out-of-order block of the dataset at an application layer in the peer-to-peer network, wherein the first out-of-order block is scanned for one or more sets of malware,
- generate an output state based on the scan of the first out-of-order block,
- perform one or more subsequent scans of other blocks of the dataset including a second out-of-order block that precedes the first out-of-order block, and
- generate output states for each of the subsequent scans;
- and
- memory that stores the output states for the first out-of-order block and the output states for the other blocks, wherein the output states are correlated to identified input states, wherein the output state for the first out-of-order block reduces a number of the identified input states used when scanning the second out-of-order block, wherein the processor identifies that the dataset includes a set of malware when the output states for the first out-of-order block and the output states for the other blocks match a pattern associated with the identified set of malware.
Dependencies are inferred from the claim text.