Target-based smb and dce/rpc processing for an intrusion detection system or instrusion prevention system

A method performed in a processor of an intrusion detection/prevention system (IDS/IPS), for checking for valid packets in a server message block (SMB) named pipe in a communication network, comprising:

• receiving, in a processor configured as an IDS/IPS, a fragment/segment, and determining a kind of application of a target of the fragment/segment in response to receiving the fragment/segment;
• separating, in the IDS/IPS, fragments/segments with a same multiplex ID (MID) as part of a same SMB transaction command from fragments/segments with a different MID, the MID being in the SMB frame header, all for fragments/segments in the same SMB named pipe, when a reassembly table indicates that the kind of application of the target separates based on MID;
• and
• processing, in the IDS/IPS, the same SMB transaction command with the same MID as being in a separate SMB transaction command instead of with the fragments/segments with the different MID when the kind of application of the target separates based on MID.

A method performed in a processor of an intrusion detection/prevention system (IDS/IPS), for reassembling distributed computing environment/remote procedure call (DCE/RPC) request fragments, comprising:

• receiving, in a processor configured as an IDS/IPS, plural request fragments belonging to a single DCE/RPC request;
• determining, in the IDS/IPS, the kind of application of a target of the DCE/RPC request;
• selecting, in the IDS/IPS, one of the request fragments as a source of a context ID depending on the target kind of application as indicated in a reassembly table;
• reassembling, in the IDS/IPS, the plural request fragments into a reassembled request;
• and
• inserting, in the IDS/IPS, the context ID from the selected request fragment into the context ID of a DCE/RPC header of the reassembled request.

A method performed in a processor of an intrusion detection/prevention system (IDS/IPS), for reassembling request fragments, comprising:

• receiving, in a processor configured as an IDS/IPS, plural request fragments belonging to a single request;
• determining, in the IDS/IPS, the kind of application of a target of the request;
• selecting, in the IDS/IPS, one of the request fragments as a source of an operation number as indicated in a reassembly table depending on the target kind of application;
• reassembling, in the IDS/IPS, the plural request fragments into a reassembled request;
• and
• inserting, in the IDS/IPS, the operation number from a distributed computing environment/remote procedure call (DCE/RPC) header of the selected request fragment into the operation number of a DCE/RPC header of the reassembled request.