Method and system for classifying a protocol message in a data communication network
AssigneeSecurity Matters Ltd.
InventorEmmanuele Zambon
Life of this patent
Estimating the term…
Abstract
An intrusion detection method for detecting an intrusion in data traffic on a data communication network parses the data traffic to extract at least one protocol field of a protocol message of the data traffic, and associates the extracted protocol field with a model for that protocol field. The model is selected from a set of models. An assessment is made to determine if a contents of the extracted protocol field is in a safe region as defined by the model, and an intrusion detection signal is generated in case it is established that the contents of the extracted protocol field is outside the safe region. The set of models may comprise a corresponding model for each protocol field of a set of protocol fields.
Claims39
A method of monitoring data traffic on a data communication network, the method comprising:
- parsing the data traffic to extract at least one protocol field of a protocol message of the data traffic;
- associating the extracted protocol field with a respective model for that protocol field, the model being selected from a set of models, the set of models comprising different models for different protocol fields;
- assessing if a contents of the extracted protocol field is in a safe region as defined by the model;
- and
- generating an intrusion detection signal in case it is established that the contents of the extracted protocol field is outside the safe region,
- wherein in a learning phase a model is built for the extracted protocol field, the learning phase comprising:
- providing a plurality of model types,
- determining a data type of the extracted protocol field,
- selecting a model type for the extracted protocol field from the plurality of model types on the basis of a characteristic of the extracted protocol field, the characteristic comprising the determined data type, and
- building the model for the extracted protocol field on the basis of the selected model type.
A data communication network comprising:
- an intrusion detection system for detecting an intrusion in data traffic on the data communication network, the intrusion detection system comprising:
- a parser for parsing the data traffic to extract at least one protocol field of a protocol message of the data traffic;
- an engine for associating the extracted protocol field with a respective model for that protocol field, the model being selected from a set of models, the set of models comprising different models for different protocol fields;
- a model handler for assessing if a contents of the extracted protocol field is in a safe region as defined by the model;
- and
- an actuator for generating an intrusion detection signal in case it is established that the contents of the extracted protocol field is outside the safe region,
- wherein the system is arranged for, in a learning phase, build a model for the extracted protocol field, the learning phase comprising:
- providing a plurality of model types,
- determining a data type of the extracted protocol field,
- selecting a model type for the extracted protocol field from the plurality of model types on the basis of a characteristic of the extracted protocol field, the characteristic comprising the determined data type, and
- building the model for the extracted protocol field on the basis of the selected model type.
A data center comprising an intrusion detection system for detecting an intrusion in data traffic on a data communication network of the data center, the intrusion detection system comprising:
- a parser for parsing the data traffic to extract at least one protocol field of a protocol message of the data traffic;
- an engine for associating the extracted protocol field with a respective model for that protocol field, the model being selected from a set of models, the set of models comprising different models for different protocol fields;
- a model handler for assessing if a contents of the extracted protocol field is in a safe region as defined by the model;
- and
- an actuator for generating an intrusion detection signal in case it is established that the contents of the extracted protocol field is outside the safe region,
- wherein the system is arranged for, in a learning phase, build a model for the extracted protocol field, the learning phase comprising:
- providing a plurality of model types,
- determining a data type of the extracted protocol field,
- selecting a model type for the extracted protocol field from the plurality of model types on the basis of a characteristic of the extracted protocol field, the characteristic comprising the determined data type, and
- building the model for the extracted protocol field on the basis of the selected model type.
An industrial plant comprising an intrusion detection system for detecting an intrusion in data traffic on a data communication network of the industrial plant, the intrusion detection system comprising:
- a parser for parsing the data traffic to extract at least one protocol field of a protocol message of the data traffic;
- an engine for associating the extracted protocol field with a respective model for that protocol field, the model being selected from a set of models, the set of models comprising different models for different protocol fields;
- a model handler for assessing if a contents of the extracted protocol field is in a safe region as defined by the model;
- and
- an actuator for generating an intrusion detection signal in case it is established that the contents of the extracted protocol field is outside the safe region,
- wherein the system is arranged for, in a learning phase, build a model for the extracted protocol field, the learning phase comprising:
- providing a plurality of model types,
- determining a data type of the extracted protocol field,
- selecting a model type for the extracted protocol field from the plurality of model types on the basis of a characteristic of the extracted protocol field, the characteristic comprising the determined data type, and
- building the model for the extracted protocol field on the basis of the selected model type.
An office data network comprising an intrusion detection system for detecting an intrusion in data traffic on the office data network, the intrusion detection system comprising:
- a parser for parsing the data traffic to extract at least one protocol field of a protocol message of the data traffic;
- an engine for associating the extracted protocol field with a respective model for that protocol field, the model being selected from a set of models, the set of models comprising different models for different protocol fields;
- a model handler for assessing if a contents of the extracted protocol field is in a safe region as defined by the model;
- and
- an actuator for generating an intrusion detection signal in case it is established that the contents of the extracted protocol field is outside the safe region,
- wherein the system is arranged for, in a learning phase, build a model for the extracted protocol field, the learning phase comprising:
- providing a plurality of model types,
- determining a data type of the extracted protocol field,
- selecting a model type for the extracted protocol field from the plurality of model types on the basis of a characteristic of the extracted protocol field, the characteristic comprising the determined data type, and
- building the model for the extracted protocol field on the basis of the selected model type.
Dependencies are inferred from the claim text.