Back to results
US 7,216,364 B2Granted
System security approaches using state tables
AssigneeLionic Corporation
InventorsShi-Ming Zhao, Shih-Wei Chien
Life of this patent
Estimating the term…
Abstract
A method and system that ensures system security is disclosed. Specifically, the method and system formulate a finite automaton that corresponds to a number of patterns. Then, as data units are put through the finite automaton, suspected data units are identified. The suspected data units are the ones containing content that collectively matches one or more of the aforementioned patterns. To identify the suspected data units, the dependency relationships among various states in the finite automaton that have been compressed are relied upon. Depending on the result of identifying the suspected data units, different actions are performed.
Claims40
A method, comprising:
- formulating a finite automaton that corresponds to a plurality of patterns, wherein said finite automaton includes a plurality of states and dependency relationships among said states;
- compressing said dependency relationships to generate
- a set of binary bits that correspond to occurrences of distinct state transitions for each of said plurality of said states and
- a subset of states out of said plurality of said states;
- putting a plurality of data units through said finite automaton;
- identifying a set of suspected data units out of said plurality of said data units, wherein the content of said set of said suspected data units collectively matches any of said plurality of said patterns using said set of said set of said binary bits and said subsets of said states;
- and
- performing an action based on the result of said identifying of said set of said suspected data units.
5 more elements
A computer-readable medium containing one or more sequences of instructions for ensuring system security, which instructions, when executed by one or more processors, cause the one or more processors to:
- formulate a finite automaton that corresponds to a plurality of patterns;
- compress state transition information of said finite automaton to generate a set of compressed data;
- put a plurality of data units through said finite automaton;
- identify a set of suspected data units out of said plurality of said data units, wherein the content of said set of said suspected data units collectively matches any of said patterns using said set of said compressed data;
- and
- perform an action based on the result of said identifying said suspected data units.
3 more elements
A method, comprising:
- formulating a finite automaton that corresponds to a plurality of patterns;
- putting a plurality of data units through said finite automaton;
- identifying a set of suspected data units out of said plurality of said data units, wherein the content of said set of said suspected data units collectively matches any of said patterns using dependency relationships among a plurality of states in said finite automaton, wherein said dependency relationships have been compressed;
- and
- performing an action based on the result of said identifying said suspected data units.
2 more elements
A system, comprising:
- means for formulating a finite automaton that corresponds to a plurality of patterns;
- means for putting a plurality of data units through said finite automaton;
- means for identifying a set of suspected data units out of said plurality of said data units, wherein the content of said set of said suspected data units collectively matches any of said patterns using dependency relationships among a plurality of states in said finite automaton, wherein said dependency relationships have been compressed;
- and
- means for performing an action based on the result of said identifying said suspected data units.
2 more elements
A system, comprising:
- a processor,
- a bus, coupled to said processor,
- a communication interface, coupled to said bus, wherein said communication interface receives a plurality of data units,
- a main memory, coupled to the bus, wherein said memory includes instructions when executed by said processor, causes said processor to:
- formulate a finite automaton that corresponds to a plurality of patterns;
- put said plurality of said data units through said finite automaton;
- identify a set of suspected data units out of said plurality of said data units, wherein the content of said set of said suspected data units collectively matches any of said patterns using dependency relationships among a plurality of states in said finite automaton, wherein said processor has compressed said dependency relationships;
- and
- perform an action based on the result of said identifying said suspected data units.
6 more elements
A system, comprising:
- a processor,
- a co-processing unit, electrically coupled to said processor, wherein said co-processing unit:
- formulates a finite automaton that corresponds to a plurality of patterns;
- puts a plurality of data units said system receives through said finite automaton;
- identifies a set of suspected data units out of said plurality of said data units, wherein the content of said set of said suspected data units collectively matches any of said patterns using dependency relationships among a plurality of states in said finite automaton, wherein said co-processing unit has compressed said dependency relationships;
- and
- performs an action based on the result of said identifying said suspected data units.
4 more elements
Dependencies are inferred from the claim text.