System and Method for Intrusion Detection of Malware Traffic
AssigneeMarvell Asia Pte Ltd
InventorsDovrat Zifroni, Michael Shamis
Life of this patent
Estimating the term…
Abstract
A system-on-a-chip (SoC) and corresponding method implement an intrusion detection system. The SoC comprises a plurality of hardware engines. The SoC employs the plurality of hardware engines to implement the intrusion detection system. The intrusion detection system is capable of detecting malware traffic in (i) a non-encrypted traffic stream, (ii) an encrypted traffic stream that can be decrypted by the SoC, and (iii) an encrypted traffic stream that cannot be decrypted by the SoC. The intrusion detection system performs an action responsive to detecting the malware traffic. The action is performed toward preventing malicious activity otherwise caused by the malware traffic.
Claims38
A system-on-a-chip (SoC) comprising:
- a plurality of hardware engines, the SoC configured to employ the plurality of hardware engines to implement an intrusion detection system (IDS) configured to detect malware traffic in (i) a non-encrypted traffic stream, (ii) an encrypted traffic stream that can be decrypted by the SoC, and (iii) an encrypted traffic stream that cannot be decrypted by the SoC,
- the IDS further configured to perform an action responsive to detecting the malware traffic in a received traffic stream that is (i), (ii), or (iii), the action performed toward preventing malicious activity otherwise caused by the malware traffic.
of claim 6, wherein the SoC further comprises a traffic scanner, wherein the DPI engine is configured to process non-encrypted traffic content and wherein, in an event the received traffic stream is classified by the classifier as (i), the traffic scanner is configured to cause the DPI engine to process the received traffic stream to detect the malware traffic.
A method comprising:
- receiving, at a system-on-a-chip (SoC), a traffic stream, the SoC including a plurality of hardware engines, the SoC employing the plurality of hardware engines to implement an intrusion detection system (IDS) capable of detecting malware traffic in (i) a non-encrypted traffic stream, (ii) an encrypted traffic stream that can be decrypted by the SoC, and (iii) an encrypted traffic stream that cannot be decrypted by the SoC;
- detecting, by the IDS of the SoC, the malware traffic in the traffic stream received, the traffic stream received as (i), (ii), or (iii);
- and
- performing an action responsive to the detecting, the action performed toward preventing malicious activity otherwise caused by the malware traffic.
Dependencies are inferred from the claim text.