Intrusion detection signature analysis using regular expressions and logical operators
AssigneeCisco Technology, Inc.
InventorsSteven D. Shanklin, Thomas E. Bernhard, Gerald S. Lathem
Life of this patent
Estimating the term…
Abstract
A method of describing intrusion signatures, which are used by an intrusion detection system to detect attacks on a local network. The signatures are described using a “high level” syntax having features in common with regular expression and logical expression methodology. These high level signatures may then be compiled, or otherwise analyzed, to provide a process executable by a sensor or other processor-based signature detector.
Claims30
An intrusion detection system comprising:
- a plurality of regular expressions embodied in a computer-readable medium describing at least one intrusion signature used in detecting intrusion to a network, the regular expressions comprising:
- a set of packet types represented by a set of regular expression identifiers;
- and
- logical operators describing relationships between the packet types;
- and
- an intrusion detection sensor operable to examine packets of data and compare the packets to the plurality of regular expressions describing intrusion signatures.
An intrusion detection system comprising:
- a plurality of regular expressions embodied in a computer-readable medium describing at least one intrusion signature used in detecting intrusion to a network, the regular expressions comprising:
- a set of packet types represented by a set of regular expression identifiers;
- and
- logical operators describing relationships between the packet types;
- and
- logic encoded in a computer-readable medium operable to examine packets of data and compare the packets to regular expressions describing intrusion signatures.
An intrusion detection system comprising:
- a plurality of regular expressions embodied in a computer-readable medium describing at least one intrusion signature used in detecting intrusion to a network, the regular expressions comprising:
- a set of signature events represented by a set of regular expression identifiers;
- and
- logical operators describing relationships between the signature events;
- and
- an intrusion detection sensor operable to examine network traffic and compare the traffic to the regular expressions describing intrusion signatures.
An intrusion detection system comprising:
- a plurality of regular expressions embodied in a computer-readable medium describing at least one intrusion signature used in detecting intrusion to a network, the regular expressions comprising:
- a set of signature events represented by a set of regular expression identifiers;
- and
- logical operators describing relationships between the signature events;
- and
- logic encoded in a computer-readable medium operable to examine network traffic and compare the traffic to regular expressions describing intrusion signatures.
Dependencies are inferred from the claim text.