# US 2024/0205247 A1 · Intrusion protection system (ips) for hash-based string detection without memory lookup table

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2024/0205247 A1
- Document ID: US20240205247A1
- Status: Published application
- Kind: A1
- Application number: 18/081,659
- Filed: 2022-12-14
- Published: 2024-06-20
- Earliest claimed: 2022-12-14
- Assignees: Fortinet, Inc.
- Applicants: Fortinet, Inc.
- Inventors: Yuwei Zhang; Shushan Wen
- Web page: https://patentgrep.com/patent/US20240205247A1

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 11/1096: {Parity calculation or recalculation after configuration or reconfiguration of the system}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A CRC rule is generated for each CRC parity check circuit from a bank of CRC parity check circuits for mapping a fixed-length CRC output to a signature, each of the CRC parity check circuits servicing a specific string length. The selected CRC parity circuit outputs a fixed-length parity-check data for the specific data packet, and the string mapper maps the fixed-length parity-check data for the specific data packet to one of the string identifiers associated with the group of signatures. If a fixed-length parity-check match is found, outputting a string identifier of the match for a security action.

## Claims

### Claim 1

A computer-implemented method in an intrusion protection system (IPS) device on a data communication network for hash-based string detection of variable length signatures from data packets using fixed logic memory and without using a memory lookup table for stored signatures, the method comprising:
receiving, prior to deployment to real-time network traffic, a group of rule-based signatures as configuration input, each signature comprising a string identifier, a string length, and a character string;
generating a cyclic redundancy check (CRC) rule for each CRC parity check circuit from a bank of CRC parity check circuits for mapping a fixed-length CRC output to a signature, each of the CRC parity check circuits servicing a specific string length;
receiving, in real-time network traffic, a specific data packet from a session of data packets on the data communication network;
analyzing the specific data packet to determine whether a character string of the specific data packet matches fixed-length CRC output for at least one of the stored signatures, wherein the character string of the specific data packet is hashed using a CRC parity check circuit corresponding to a length of the character string to output a fixed-length parity-check data for the specific data packet, and wherein a string mapper maps the fixed-length parity-check data for the specific data packet to one of the string identifiers associated with the group of signatures; and
if a fixed-length parity-check match is found, outputting a string identifier of the match to a signature-based rule for a security action.

### Claim 2 (depends on 1)

The method of claim 1, wherein the step of generating the CRC rules comprises:
dividing each signature of the group of signatures into a subgroup based on string length,
hashing each signature with one of the CRC parity check circuits selected by string length, to determine a fixed length CRC output for each signature, and
storing the fixed-length CRC output for each signature in association with at least one of the signatures as a baseline for identifying the signature.

### Claim 3 (depends on 1)

The method of claim 1, wherein the step of analyzing the specific data packet further comprises:
checking subgroup screening rule; and
performing a final target check.

### Claim 4 (depends on 1)

The method of claim 1, further comprising: taking a security action based on the signature associated with the string identifier.

### Claim 5 (depends on 1)

The method of claim 1, wherein at least one more data packet from the session is analyzed for signature matching.

### Claim 6

A non-transitory computer-readable media storing source code in an intrusion protection system (IPS) device on a data communication network that, when executed by a processor, performs a method for hash-based string detection of variable length signatures from data packets using fixed logic memory and without using a memory lookup table for stored signatures, the method comprising the steps of:
receiving, prior to deployment to real-time network traffic, a group of rule-based signatures as configuration input, each signature comprising a string identifier, a string length, and a character string;
generating a cyclic redundancy check (CRC) rule for each CRC parity check circuit from a bank of CRC parity check circuits for mapping a fixed-length CRC output to a signature, each of the CRC parity check circuits servicing a specific string length;
receiving, in real-time network traffic, a specific data packet from a session of data packets on the data communication network;
analyzing the specific data packet to determine whether a character string of the specific data packet matches fixed-length CRC output for at least one of the stored signatures,
wherein the character string of the specific data packet is hashed using a CRC parity check circuit corresponding to a length of the character string and a string mapper circuit, wherein the CRC parity circuit outputs a fixed-length parity-check data for the specific data packet, and the string mapper maps the fixed-length parity-check data for the specific data packet to one of the string identifiers associated with the group of signatures; and
if a fixed-length parity-check match is found, outputting a string identifier of the match for a security action.

### Claim 7 (depends on 1)

The method of claim 1, wherein the step of generating the CRC rules comprises:
dividing each signature of the group of signatures into a subgroup based on string length,
hashing each signature with one of the CRC parity check circuits selected by string length, to determine a fixed length CRC output for each signature, and
storing the fixed-length CRC output for each signature in association with at least one of the signatures as a baseline for identifying the signature.

### Claim 8

An intrusion protection system (IPS) device on a data communication network for hash-based string detection of variable length signatures from data packets using fixed logic memory and without using a memory lookup table for stored signatures, comprising:
a signature database to receive, prior to deployment to real-time network traffic, a group of rule-based signatures as configuration input, each signature comprising a string identifier, a string length, and a character string;
a cyclic redundancy check (CRC) rule generator to generate a CRC rule for each CRC parity check circuit from a bank of CRC parity check circuits for mapping a fixed-length CRC output to a signature, each of the CRC parity check circuits servicing a specific string length;
a packet queue to receive, in real-time network traffic, a specific data packet from a session of data packets on the data communication network;
a string ID mapper to analyze the specific data packet to determine whether a character string of the specific data packet matches fixed-length CRC output for at least one of the stored signatures,
wherein the character string of the specific data packet is hashed using a CRC parity check circuit corresponding to a length of the character string and a string mapper circuit, wherein the CRC parity circuit outputs a fixed-length parity-check data for the specific data packet, and the string mapper maps the fixed-length parity-check data for the specific data packet to one of the string identifiers associated with the group of signatures, and
wherein if a fixed-length parity-check match is found, outputting a string identifier of the match for a security action.