US 2006/0133377 A1Published application

System and method for integrated header, state, rate and content anomaly prevention with policy enforcement

AssigneeIntruGuard Device, Inc.

InventorHemant Jain

Life of this patent

Estimating the term…

Loading patent…

Abstract

The present invention provides an integrated prevention of header, state, rate and content anomalies along with network policy enforcement. A hardware based apparatus classifies layers 2, 3, 4 and 7 network data and maintains rate-thresholds through continuous and adaptive learning. In the process of classifying the packets, the apparatus can determine header and state anomalies and drop packets containing those anomalies. Accurate detection and prevention of layer 7 content anomalies is achieved using fragment assembly, TCP reorder and retransmission removal components, which also identify anomalies in those areas. Content inspection is achieved at high speed through a Content Inspection Engine. The apparatus integrates advantageous solutions to prevent anomalous packets and enables a policy based packet filter.

Claims20

Dependent claims

An apparatus capable of enforcing network policies and preventing attacks related to header, state, rate and content anomalies, said apparatus comprising:

a) a Packet Interface capable of
receiving inbound/outbound packets,
storing the packets in a memory buffer,
releasing the packet with a packet-id to subsequent blocks for inspection,
dropping the packets altogether, and
sending the packets onto forensic ports based on a unified decision;
b) a Classifier coupled to the Packet Interface and capable of
classifying packets received from the Packet Interface, and
retrieving layer 2, layer 3, layer 4, and layer 7 header information from the packets;
c) a Header and State Anomaly Prevention Engine coupled to the Classifier via a classification bus and capable of determining layers 2, 3, 4, and 7 header and state anomalies;
d) a Continuous and Adaptive Rate Anomaly Prevention Engine coupled to the classification bus and capable of determining and estimating rate thresholds for layers 2, 3, 4, and 7 parameters and subsequently determining rate anomalies for these parameters;
e) a Recon Prevention Engine coupled to the classification bus and capable of determining recon activities at layers 3 and 4;
f) a Content Anomaly Engine coupled to the classification bus and capable of determining known attacks using signatures;
g) a Policy Lookup Engine coupled to the classification bus and capable of determining policy violation in packets;
and
h) a Decision Multiplexer for generating the unified decision about a packet-id based on information received from a plurality of sources including the Header and State Anomaly Prevention Engine, the Continuous and Adaptive Rate Anomaly Prevention Engine, the Recon Prevention Engine, the Content Anomaly Engine, and the Policy Lookup Engine.

13 more elements

A system for enforcing network policies and preventing attacks related to header, state, rate and content anomalies, said system comprising:

a controlling host;
an apparatus coupled to the controlling host, comprising:
a) a Packet Interface for
receiving inbound/outbound packets,
storing the packets in a memory buffer,
releasing the packet with a packet-id to subsequent blocks for inspection,
dropping the packets altogether, and
sending the packets onto forensic ports based on a unified decision;
b) a Classifier coupled to the Packet Interface and capable of
classifying packets received from the Packet Interface, and
retrieving layer 2, layer 3, layer 4, and layer 7 header information from the packets;
c) a Header and State Anomaly Prevention Engine coupled to the Classifier via a classification bus and capable of determining layers 2, 3, 4, and 7 header and state anomalies;
d) a Continuous and Adaptive Rate Anomaly Prevention Engine coupled to the classification bus and capable of determining and estimating rate thresholds for layers 2, 3, 4, and 7 parameters and subsequently determining rate anomalies for these parameters;
e) a Recon Prevention Engine coupled to the classification bus and capable of determining recon activities at layers 3 and 4;
f) a Content Anomaly Engine coupled to the classification bus and capable of determining known attacks using signatures;
g) a Policy Lookup Engine coupled to the classification bus and capable of determining policy violation in packets;
and
h) a Decision Multiplexer for generating the unified decision about a packet-id based on information received from a plurality of sources including the Header and State Anomaly Prevention Engine, the Continuous and Adaptive Rate Anomaly Prevention Engine, the Recon Prevention Engine, the Content Anomaly Engine, and the Policy Lookup Engine;
and
i) a host interface for setting necessary data structures in memory of logic blocks through host commands.

17 more elements

Dependencies are inferred from the claim text.