Method and an apparatus to perform multiple packet payloads analysis
AssigneeSonicWALL, Inc.
InventorsAleksandr Dubrovsky, Roman Yanovsky, Scott More, Boris Yanovsky
Life of this patent
Estimating the term…
Abstract
A method and an apparatus to perform multiple packet payload analysis have been disclosed. In one embodiment, the method includes receiving a plurality of data packets, each of the plurality of data packets containing a portion of a data pattern, determining whether each of the plurality of data packets is out of order, and making and storing a local copy of the corresponding data packet if the corresponding data packet is out of order. Other embodiments have been claimed and described.
Claims43
A method comprising:
- receiving a plurality of data packets at an intrusion detection/prevention system (IPS), each of the plurality of data packets containing a portion of a data pattern;
- determining whether each of the plurality of data packets is out of order;
- and
- making and storing a local copy of the corresponding data packet if the corresponding data packet is out of order, wherein the local copy is to be used in pattern matching to scan for an attack pattern so that at least one of a plurality of packets containing portions of the attack pattern is blocked.
A machine-accessible medium that provides instructions that, if executed by a processor, will cause the processor to perform operations comprising:
- receiving a plurality of data packets at an intrusion detection/prevention system (IPS), each of the plurality of data packets containing a portion of a data pattern;
- determining whether each of the plurality of data packets is out of order;
- and
- making and storing a local copy of the corresponding data packet if the corresponding data packet is out of order, wherein the local copy is to be used in pattern matching to scan for an attack pattern so that at least one of a plurality of packets containing portions of the attack pattern is blocked.
An apparatus comprising:
- an interface to receive data packets;
- and
- a processor to perform pattern matching on the data packets on a packet-by-packet basis without reassembling the data packets in order to scan for an attack pattern, wherein the data packets include in-order data packets and out-of-order data packets.
A system comprising:
- at least one client application;
- a network;
- and
- an intrusion detection/prevention system (IPS) communicably coupled between the at least one client application and the network, the IPS comprising:
- an interface to receive data packets;
- and
- a processor to perform pattern matching on the data packets on a packet-by-packet basis without reassembling the data packets in order to scan for an attack pattern, wherein the data packets include in-order data packets and out-of-order data packets.
A method comprising:
- responsive to receiving each packet of a sequence of packets that may be received out of sequence order, performing the following:
- if there are one or more of the packets that precede the current packet in the sequence of packets that have not yet been received, then buffering the current packet and sending the current packet on;
- and
- if there are not one or more of the packets that precede the current packet in the sequence of packets that have not yet been received, then performing the following,
- performing pattern matching using Deterministic Finite Automata (DFAs) on any of the packets that precede the current packet in the sequence of packets that have been buffered and not yet processed for pattern matching and on the current packet;
- if there is an attack pattern match, block the current packet;
- if there is not an attack pattern match, sending on the current packet.
A machine-accessible medium that provides instructions that, if executed by a processor, will cause the processor to perform operations comprising:
- responsive to receiving each packet of a sequence of packets that may be received out of sequence order, performing the following:
- if there are one or more of the packets that precede the current packet in the sequence of packets that have not yet been received, then buffering the current packet and sending the current packet on;
- and
- if there are not one or more of the packets that precede the current packet in the sequence of packets that have not yet been received, then performing the following,
- performing pattern matching using Deterministic Finite Automata (DFAs) on any of the packets that precede the current packet in the sequence of packets that have been buffered and not yet processed for pattern matching and on the current packet;
- if there is an attack pattern match, block the current packet;
- if there is not an attack pattern match, sending on the current packet.
Dependencies are inferred from the claim text.