Back to results
US 8,510,791 B2Granted
Method and system for dynamic protocol decoding and analysis
AssigneeTrend Micro Incorporated
InventorKevin Gerard Boyce
Life of this patent
Estimating the term…
Abstract
A method for dynamically decoding protocol data on a computer system is provided using a protocol decoder, which inspects and analyzes protocol data received by the computer system. A protocol decoding program controls the decoding and analysis process. The method may be used by an intrusion prevention system to identify anomalous protocol data that may cause harm to applications receiving the data.
Claims18
A method for dynamic protocol decoding, comprising:
- employing at least one hardware processor for:
- (a) providing a protocol decoding program adapted to analyze data received from a network in an intrusion detection system, the protocol decoding program comprising concrete type instructions of at least two types and pseudo type instructions of at least two types, each concrete type instruction implying a different value specifying a number of bytes and causing reading of a data unit of a data packet, a length of said data unit being the number of bytes defined by the respective concrete type instruction, each concrete type instruction being followed by one or more pseudo type instructions, including a pseudo type instruction of a type for operating on data contained in data units already read by concrete type instructions, the pseudo type instructions further comprising at least one pseudo type instruction of a type for controlling a program flow of the protocol decoding program;
- (b) analyzing the data packet, comprising
- executing the protocol decoding program including:
- (i) executing the concrete type instruction, the concrete type instruction causing a next data unit in the data packet to be read in sequence, the length of the next data unit being specified by the concrete type instruction being executed;
- the number of bytes to be read being dynamically defined by the concrete type instruction being executed as a parameter of said concrete type instruction, a value of the parameter being fixed;
- (ii) executing the pseudo type instruction following the execution of the concrete type instruction;
- (iii) provided a predefined condition regarding the data unit read in the step (i) is met, triggering a rule of the protocol decoding program, comprising triggering the rule by at least one of a data pattern, a signalled event, or a counter;
- and
- (iv) repeating the steps (i)-(iii) until the data packet is decoded or the analyzing step is terminated by the rule triggered in the step (iii).
7 more elements
A system for dynamic protocol decoding, comprising:
- at least one hardware processor;
- a memory device having computer readable instructions stored thereon for execution by the processor, the computer readable instructions forming a protocol decoding program comprising concrete type instructions of at least two types and pseudo type instructions of at least two types, each concrete type instruction implying a different value specifying a number of bytes, and causing reading of a data unit of a data packet, a length of said data unit being the number of bytes defined by the respective concrete type instruction, each concrete type instruction being followed by one or more pseudo type instructions, including a pseudo type instruction of a type for operating on data contained in data units already read by concrete type instructions, the pseudo type instructions further comprising at least one pseudo type instruction of a type for controlling a program flow of the protocol decoding program, and causing the processor to:
- analyze the data packet, comprising:
- executing the protocol decoding program, comprising:
- (i) executing the concrete type instruction, the concrete type instruction causing a next data unit in the data packet to be read in sequence, the length of the next data unit being specified by the concrete type instruction being executed;
- the number of bytes to be read being dynamically defined by the concrete type instruction being executed as a parameter of said concrete type instruction, a value of the parameter being fixed;
- (ii) executing the pseudo type instruction following the execution of the concrete type instruction;
- (iii) provided a predefined condition regarding the data unit read in the step (i) is met, triggering a rule of the protocol decoding program, comprising triggering the rule by at least one of a data pattern, a signalled event, or a counter;
- and
- (iv) repeating the steps (i)-(iii) until the data packet is decoded or the analyzing step is terminated by the rule triggered in the step (iii).
7 more elements
Dependencies are inferred from the claim text.