US 5,414,833 AGranted

Network security system and method using a parallel finite state machine adaptive active monitor and responder

AssigneeInternational Business Machines Corporation

InventorsPaul C. Hershey, Donald B. Johnson, An V. Le, Stephen M. Matyas, John G. Waclawsky, John D. Wilkins

Life of this patent

Estimating the term…

Loading patent…

Abstract

A system and method provide a security agent, consisting of a monitor and a responder, that respond to a detected security event in a data communications network, by producing and transmitting a security alert message to a network security manager. The alert is a security administration action which includes setting a flag in an existing transmitted protocol frame to indicate a security event has occurred. The security agent detects the transmission of infected programs and data across a high-speed communications network. The security agent includes an adaptive, active monitor using finite state machines, that can be dynamically reprogrammed in the event it becomes necessary to dynamically reconfigure it to provide real time detection of the presence of a suspected offending virus.

Claims45

Dependent claims

A network security architecture system, with an adaptable, simultaneously parallel array of finite state machines, for monitoring the security of a data communications network, comprising:

a first finite state machine in said array, including a first memory, a first address register coupled to said network, a first start signal input and a first security threat pattern detection output coupled to a first counter, said memory thereof storing a first finite state machine definition for detecting a first data security threat pattern on said network;
a second finite state machine in said array, including a second memory, a second address register coupled to said network, a second start signal input and a second security threat pattern detection output coupled to a second counter, said memory thereof storing a second finite state machine definition for detecting a second data security threat pattern on said network;
a third finite state machine in said array, including a third memory, a third address register coupled to said network, a third start signal input and a third security threat pattern detection output coupled to a third counter, said memory thereof storing a third finite state machine definition for detecting a third data security threat pattern on said network;
a programmable interconnection means coupled to said first, second and third finite state machines, for selectively interconnecting said first security threat pattern detection output to at least one of said second and third start signal inputs;
a security event vector assembly means, having inputs coupled to said first, second and third counters, for assembling a security event vector from an accumulated count value in said first counter and at least one of said second and third counters, representing a number of occurrences of said first data security threat pattern and at least one of said second and third data security threat patterns on said network;
and
a responding means, having an input coupled to said security event vector assembly means, an array output coupled to said memory of said first, second and third finite state machines, and a configuration output coupled to said programmable interconnection means, for receiving said security event vector and in response thereto, changing said array to change data security threat patterns to be detected on said network.

4 more elements

In a network security architecture system, with an adaptable, simultaneously parallel array of finite state machines, a method for monitoring the security of a data communications network, comprising:

storing a first finite state machine definition for detecting a first data security threat pattern on said network, in a first finite state machine in said array, including a first memory, a first address register coupled to said network, a first start signal input and a first security threat pattern detection output coupled to a first counter;
storing a second finite state machine definition for detecting a second data security threat pattern on said network, in a second finite state machine in said array, including a second memory, a second address register coupled to said network, a second start signal input and a second security threat pattern detection output coupled to a second counter;
storing a third finite state machine definition for detecting a third data security threat pattern on said network, a third finite state machine in said array, including a third memory, a third address register coupled to said network, a third start signal input and a third security threat pattern detection output coupled to a third counter;
selectively interconnecting said first security threat pattern detection output to at least one of said second and third start signal inputs;
assembling a security event vector from an accumulated count value in said first counter and at least one of said second and third counters, representing a number of occurrences of said first data security threat pattern and at least one of said second and third data security threat patterns on aid network;
and
receiving said security event vector and in response thereto, changing said array to change data security threat patterns to be detected on said network.

4 more elements

A method for information collection by adaptive, active security monitoring of a serial stream of data having a characteristic virus pattern including a first occurring and a second occurring virus pattern portions, comprising the steps of:

receiving x-bit words from said serial data stream, in a first n-bit address register having a first portion with n-x bits and an second portion with two bits and an input to said second portion coupled to said serial stream;
accessing a first-addressable memory having a plurality of data storage locations, each having a first portion with n-x bits, said first memory having an n-bit address input coupled an output of said first address register, said first memory configured with data stored in first and second ones of said data storage locations to represent a first digital filter for said first occurring virus pattern;
transferring data over a feedback path from an output of said first memory to an input of said first register, for transferring said data from said first one of said data storage locations in said first memory to said first portion of said first address register, for concatenation with said x-bit words from said serial bit stream to form an address for said second one of said data storage locations of said first memory;
outputting a start signal from said second one of said data storage locations of said first memory having a start signal value stored therein, which is output when said first occurring portion of said characteristic virus pattern is detected by said digital filter;
receiving x-bit words from said serial data stream, in a second p-bit address register having a first portion with p-x bits and a second portion with a plurality of x bits and an input to said second portion coupled to said serial stream, for receiving x-bit words from said serial data stream;
said second address register coupled to said first memory, for receiving said start signal value from said first memory;
accessing a second addressable memory having a plurality of data storage locations, each having a first portion with p-x bits, said second memory having a p-bit address input coupled an output of said second address register, said second memory configured with data stored in first and second ones of said data storage locations to represent a second digital filter for said second occurring virus pattern;
transferring data over a feedback path from an output of said second memory to an input of said second register, for transferring said data from said first one of said data storage locations in said second memory to said first portion of said second address register in response to said start signal value, for concatenation with said x-bit words from said serial data stream to form an address for said second one of said data storage locations of said second memory;
outputting a security alarm value from said second one of said data storage locations of said second memory having a virus pattern security alarm value stored therein, which is output when said second portion of said characteristic virus pattern is detected by said second digital filter;
counting occurrences of said second portion of said characteristic virus pattern in said data stream, with a counter coupled to said virus pattern security alarm value output, and outputting a count value as an event vector;
and
receiving said event vector and in response thereto, performing security monitoring and control operations on a data communications medium providing said data stream.

9 more elements

A method for adaptive, active security monitoring of a serial stream of data having a characteristic virus pattern including a first occurring and a second occurring virus pattern portions, comprising the steps of:

receiving x-bit words from said serial data stream, in a first n-bit address register having a first portion with n-x bits and an second portion with two bits and an input to said second portion coupled to said serial stream;
accessing a first addressable memory having a plurality of data storage locations, each having a first portion with n-x bits, said first memory having an n-bit address input coupled an output of said first address register, said first memory configured with data stored in first and second ones of said data storage locations to represent a first digital filter for said first occurring virus pattern;
transferring data over a feedback path from an output of said first memory to an input of said first register, for transferring said data from said first one of said data storage locations in said first memory to said first portion of said first address register, for concatenation with said x-bit words from said serial bit stream to form an address for said second one of said data storage locations of said first memory;
outputting a start signal from said second one of said data storage locations of said first memory having a start signal value stored therein, which is output when said first occurring portion of said characteristic virus pattern is detected by said digital filter;
receiving x-bit words from said serial data stream, in a second p-bit address register having a first portion with p-x bits and a second portion with a plurality of x bits and an input to said second portion coupled to said serial stream, for receiving x-bit words from said serial data stream;
said second address register coupled to said first memory, for receiving said start signal value from said first memory;
accessing a second addressable memory having a plurality of data storage locations, each having a first portion with p-x bits, said second memory having a p-bit address input coupled an output of said second address register, said second memory configured with data stored in first and second ones of said data storage locations to represent a second digital filter for said second occurring virus pattern;
transferring data over a feedback path from an output of said second memory to an input of said second register, for transferring said data from said first one of said data storage locations in said second memory to said first portion of said second address register in response to said start signal value, for concatenation with said x-bit words from said serial data stream to form an address for said second one of said data storage locations of said second memory;
outputting an security alarm value from said second one of said data storage locations of said second memory having a virus pattern security alarm value stored therein, which is output when said second portion of said characteristic virus pattern is detected by said second digital filter.

6 more elements

An information collection architecture system for adaptive, active security monitoring of a serial stream of data having a characteristic virus pattern including a first occurring and a second occurring virus pattern portions, for performing security monitoring and control operations on a data communications medium providing said data stream, comprising:

a first n-bit address register having a first portion with n-x bits and an second portion with a plurality of x bits and an input to said second portion coupled to said serial stream, for receiving x-bit words from said serial data stream;
first addressable memory having a plurality of data storage locations, each having a first portion with n-x bits, said first memory having an n-bit address input coupled an output of said first address register, said first memory configured with data stored in first and second ones of said data storage locations to represent a first digital filter for said first occurring virus pattern;
a feedback path from an output of said first memory to an input of said first register, for transferring said data from said first one of said data storage locations in said first memory to said first portion of said first address register, for concatenation with said x-bit words from said serial data stream to form an address for said second one of said data storage locations of said first memory;
said second one of said data storage locations of said first memory having a start signal value stored therein, which is output when said first occurring portion of said characteristic virus pattern is detected by said digital filter;
a second p-bit address register having a first portion with p-x bits and a second portion with a plurality of x bits and an input to said second portion coupled to said serial stream, for receiving x-bit words from said serial data stream;
said second address register coupled to said first memory, for receiving said start signal value from said first memory;
second addressable memory having a plurality of data storage locations, each having a first portion with p-x bits, said second memory having a p-bit address input coupled an output of said second address register, said second memory configured with data stored in first and second ones of said data storage locations to represent a second digital filter for said second occurring virus pattern;
a feedback path from an output of said second memory to an input of said second register, for transferring said data from said first one of said data storage locations in said second memory to said first portion of said second address register in response to said start signal value, for concatenation with said bit from said serial data stream to form an address for said second one of said data storage locations of said second memory;
said second one of said data storage locations of said second memory having a virus pattern security alarm value stored therein, which is output when said second portion of said characteristic virus pattern is detected by said second digital filter;
a counter coupled to said virus pattern security alarm value output, for counting occurrences of said second portion of said characteristic virus pattern in said data stream, and outputting a count value as an event counter;
and
control means, coupled to said counter, for receiving said event vector and in response thereto, performing security monitoring and control operations on a data communications medium providing said data stream.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 08/144,161Filed 27 Oct 1993
Granted: 9 May 1995
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

H04L 43/00
Arrangements for monitoring or testing data switching networks
G06F 21/564
Static detection: by virus signature recognition
H04L 63/0428
For providing a confidential data exchange among entities communicating through data packet networks: wherein the data content is protected, e.g.…
H04L 63/145
Countermeasures against malicious traffic: the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms