US 2017/0289180 A1 · FILTERING OF METADATA SIGNATURES

Abstract

Systems and methods for high performance IDS/IPS with efficient metadata filtering are provided. According to one embodiment, a signature database of an IDS/IPS is configured with multiple metadata signatures. A pre-match engine identifies a candidate packet of network traffic received by the IDS/IPS for full-feature match processing by: (i) categorizing the metadata signatures based on characteristics thereof; and (ii) processing and filtering a first set of the metadata signatures that forms part of a hash key based metadata signature category. The hash key based metadata signature category represents a category resulting from the categorization and each of the first set of metadata signatures is associated with a fixed unique hash key based on which respective metadata signatures are matched with the received network traffic to identify the candidate packet. Finally, a potential intrusion is identified by performing the full-feature match processing on the candidate packet based on full-feature match signatures.

Claims19

Dependent claims

An intrusion detection system comprising:

a signature database comprising a plurality of metadata signatures;
a full feature match engine configured to perform full-feature match processing of a candidate packet of received network traffic based on one or more full-feature match metadata signatures;
and
a pre-match engine that identifies the candidate packet of the received network traffic for full match processing by the full feature match engine, the pre-match engine comprising:
a metadata signature categorization module configured to categorize the plurality of metadata signatures into one or more metadata signature categories based on characteristics of the plurality of metadata signatures;
and
a hash key based metadata signature filtration module configured to process and filter a first set of metadata signatures of the plurality of metadata signatures that forms part of a hash key based metadata signature category, wherein the hash key based metadata signature category forms part of the one or more metadata signature categories, and wherein each of the first set of metadata signatures is associated with a fixed unique hash key based on which respective metadata signatures are matched with the received network traffic to identify the candidate packet.

4 more elements

A method comprising:

configuring a signature database of an intrusion detection system (IDS) or an intrusion prevention system (IPS) with a plurality of metadata signatures;
identifying, by a pre-match engine of the IDS or the IPS, a candidate packet of network traffic received by the IDS or the IPS for full-feature match processing by:
categorizing the plurality of metadata signatures into one or more metadata signature categories based on characteristics of the plurality of metadata signatures;
and
processing and filtering a first set of metadata signatures of the plurality of metadata signatures that forms part of a hash key based metadata signature category, wherein the hash key based metadata signature category forms part of the one or more metadata signature categories, and wherein each of the first set of metadata signatures is associated with a fixed unique hash key based on which respective metadata signatures are matched with the received network traffic to identify the candidate packet;
and
identifying a potential intrusion by performing, by a full-feature match engine of the IDS or the IPS, the full-feature match processing on the candidate packet based on one or more full-feature match metadata signatures.

4 more elements

Dependencies are inferred from the claim text.

Filtering of metadata signatures

Life of this patent

Filtering of metadata signatures

Life of this patent

Abstract

Claims19