# US 8,751,787 B2 · Method and device for integrating multiple threat security services > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,751,787 B2 - Document ID: US8751787B2 - Status: Granted - Kind: B2 - Application number: 12/331,912 - Filed: 2008-12-10 - Published: 2009-06-18 - Granted: 2014-06-10 - Earliest claimed: 2007-12-13 - Assignees: International Business Machines Corporation - Applicants: Bai Ling Wang - Inventors: Bai Ling Wang - Web page: https://patentgrep.com/patent/US8751787B2 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 69/22: Parsing or analysis of headers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and device for integrating multiple threat security services are disclosed. The method may comprise parsing an incoming packet at a current layer and analyzing the packet with respect to multiple threat security services and so that one or more threat security services needed by the packet may be determined. According to an exemplary embodiment, the current layer may be a layer in a protocol stack constructed based on the multiple threat security services. With this method, integrated multiple threat security services may filter application data and parse network packet data via a single integrated entity, and thus the efficacy of filtering application data may be improved while computation overhead may be reduced. ## Claims ### Claim 1 A method for integrating multiple threat security services, said method comprising: generating parsed packet data by parsing an incoming packet at each layer of an integrated security service stack; analyzing said generated parsed packet data at each layer of the integrated security service stack with respect to one or more patterns, wherein each of said one or more patterns corresponds to one of said multiple threat security services; and consequent to analyzing said parsed packet data with respect to said one or more patterns, determining one or more of said multiple threat security services needed by said parsed packet data by forming a matching algorithm for each layer of said integrated security service stack, wherein forming said matching algorithm comprises assigning a tag to each of said one or more patterns, and wherein each tag identifies one of said multiple threat security services. ### Claim 2 (depends on 1) The method according to claim 1, wherein said integrated security service stack is a protocol stack constructed based on said multiple threat security services. ### Claim 3 (depends on 1) The method according to claim 1, wherein each of said one or more patterns corresponds to a layer of said integrated security service stack. ### Claim 4 (depends on 1) The method according to claim 1, wherein forming said matching algorithm for each layer of said integrated security service stack comprises merging all of said one or more patterns corresponding to the layer into a pattern set. ### Claim 5 (depends on 1) The method according to claim 1, wherein said matching algorithm is a string matching algorithm. ### Claim 6 (depends on 1) The method according to claim 1, wherein determining one or more of said multiple threat security services needed by said parsed packet data further comprises: for each layer of said integrated security service stack: filtering parsed packet data at the layer by invoking a matching algorithm for the layer; and returning one or more tagged results identifying one or more of said multiple threat security services. ### Claim 7 (depends on 1) The method according to claim 1, wherein said multiple threat security services include at least one of an anti virus service, an anti spam service, an intrusion detection/protection system, a firewall, or a worm filter. ### Claim 8 (depends on 1) The method according to claim 1, wherein generating parsed packet data comprises parsing said incoming packet via at least one of an Internet Protocol (IP) parser, a Transmission Control Protocol (TCP) parser, an application layer protocol parser, or a file parser. ### Claim 9 A device for integrating multiple threat security services, said device comprising: a plurality of parsers, loaded in a computer, wherein each of said plurality of parsers is configured for generating parsed packet data by parsing an incoming packet at each layer of an integrated security service stack; and an analyzer, also loaded in said computer, configured for analyzing said generated parsed packet data at each layer of the integrated security service stack with respect to one or more patterns and determining one or more of said multiple threat security services needed by said parsed packet data by forming a matching algorithm for each layer of said integrated security service stack consequent to analyzing said parsed packet data with respect to said one or more patterns, wherein each of said one or more patterns corresponds to one of said multiple threat security services, wherein forming said matching algorithm comprises assigning a tag to each of said one or more patterns, and wherein each tag identifies one of said multiple threat security services. ### Claim 10 (depends on 9) The device according to claim 9, wherein said integrated security service stack is a protocol stack constructed based on said multiple threat security services. ### Claim 11 (depends on 9) The device according to claim 9, wherein each of said one or more patterns corresponds to a layer of said integrated security service stack. ### Claim 12 (depends on 9) The device according to claim 9, wherein said analyzer is configured for forming a matching algorithm for each layer of said integrated security service stack by merging all of said one or more patterns corresponding to the layer into a pattern set. ### Claim 13 (depends on 9) The device according to claim 9, wherein said matching algorithm is a string matching algorithm. ### Claim 14 (depends on 9) The device according to claim 9, wherein said analyzer is further configured for determining one or more of said multiple threat security services needed by said parsed packet data by: for each layer of said integrated security service stack: filtering parsed packet data at the layer by invoking a matching algorithm for the layer; and returning one or more tagged results identifying one or more of said multiple threat security services. ### Claim 15 (depends on 9) The device according to claim 9, wherein said multiple threat security services include at least one of an anti virus service, an anti spam service, an intrusion detection/protection system, a firewall, or a worm filter. ### Claim 16 (depends on 9) The device according to claim 9, wherein said plurality of filters include at least one of an Internet Protocol (IP) parser, a Transmission Control Protocol (TCP) parser, an application layer protocol parser, or a file parser.