US 8,789,180 B1Granted

Multi-layered application classification and decoding

AssigneeJuniper Networks, Inc.

InventorsSiying Yang, Krishna Narayanaswamy

Life of this patent

Estimating the term…

Loading patent…

Abstract

An intrusion detection system is described that is capable of applying a plurality of stacked (layered) application-layer decoders to extract encapsulated application-layer data from a tunneled packet flow produced by multiple applications operating at the application layer, or layer seven (L7), of a network stack. In this was, the IDS is capable of performing application identification and decoding even when one or more software applications utilize other software applications as for data transport to produce packet flow from a network device. The protocol decoders may be dynamically swapped, reused and stacked (layered) when applied to a given packet or packet flow.

Claims34

Dependent claims

A method comprising:

processing a packet flow with a network device to identify a first application-layer communication protocol associated with the packet flow and a second application-layer communication protocol that is using the first application-layer communication protocol as a data transport within the packet flow, wherein each of the first application-layer communication protocol and the second application-layer communication protocol comprises an independent application-layer communication protocol;
after identification of the first application-layer communication protocol and the second application-layer communication protocol, dynamically constructing, based on the identification, a stack comprising an ordered arrangement of two or more application-layer decoders, each of the application-layer decoders configured to extract application-layer data from packet data conforming to a respective communication protocol;
applying, with the network device, the stack of the application-layer decoders to the packet flow in accordance with the ordered arrangement to extract first application-layer data for the first application-layer communication protocol and to extract second application-layer data that is encapsulated within the first application-layer data in accordance with the second application-layer communication protocol;
inspecting, with the network device, the second application-layer data;
and
executing a programmed action with the network device in response to the inspection of the second application-layer data.

3 more elements

A network firewall comprising:

a plurality of application-layer decoders, each of the application-layer decoder configured to extract application-layer data from packet data conforming to a respective communication protocol;
a network interface to receive a packet flow;
an application identification module to process the packet flow to identify a first application-layer communication protocol associated with the packet flow and a second application-layer communication protocol that is using the first application-layer communication protocol as a data transport within the packet flow, wherein each of the first type of application-layer communication protocol and the second type of application-layer communication protocol comprises an independent application-layer communication protocol;
a decoder selection module to dynamically construct, based on identification of the first application-layer communication protocol and the second application-layer communication protocol, a stack comprising an ordered arrangement of two or more of the application-layer decoders, wherein decoder selection module arranges the stack of application-layer decoders to extract first application-layer data for the first application-layer communication protocol within the packet flow and extract second application-layer data that is encapsulated within the first application-layer data in accordance with the second application-layer communication protocol;
a stateful inspection engine to inspect the second application-layer data;
and
a forwarding component to execute an action in response to the inspection of the second application-layer data.

4 more elements

A network firewall comprising:

a plurality of application-layer decoders, each of the application-layer decoder configured to extract application-layer data from packet data conforming to a respective communication protocol;
a network interface to receive a packet flow;
an application identification module to process the packet flow to identify a first application-layer communication protocol associated with the packet flow and a second application-layer communication protocol that is using the first application-layer communication protocol as a data transport within the packet flow, wherein each of the first type of application-layer communication protocol and the second type of application-layer communication protocol comprises an independent application-layer communication protocol;
and
a stateful inspection engine to dynamically select, based on identification of the first application-layer communication protocol and the second application-layer communication protocol, a first decoder associated with the first application-layer communication protocol and a second decoder associated with the second application-layer communication protocol,
wherein the first decoder is configured to process the packet flow to produce a first set of application-layer communications that conform to the first application-layer communication protocol, and wherein the second decoder is configured to process the first set of application-layer communications to produce a second set of application-layer communications that conform to the second application-layer communication protocol, and
wherein the stateful inspection engine arranges the selected first decoder and second decoder within the stack such that the first decoder processes packets from the packet flow to extract the first application-layer data and outputs the first application-layer data as input to the second decoder.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application: 13/367,183Filed 6 Feb 2012 · continuation
Priority: 8 Nov 2007
Granted: 22 Jul 2014
Term ends: Not estimatedThe source records don’t support an estimate.

Classification14 codes

H04L 63/0245
Filtering policies: filtering by information in the payload
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
H04L 12/00
Data switching networks
H04L 12/4633
Interconnection of networks: interconnection of networks using encapsulation techniques, e.g. tunneling

Family

Application11/937,163Parent of this continuation · filed 8 Nov 2007
US 8,112,800 B1Parent of this continuation
US 8,789,180 B1This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key