Detecting network traffic content

A device for detecting network traffic content, the device comprising:

• a first physical input port to receive signatures of content desired to be detected;
• a second physical input port to receive, over a first network, network traffic content;
• a physical output port to retransmit, over a second network, processed network traffic content;
• a memory configured for storing one or more signatures received via the first physical input port, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
• a processor configured to receive, via the second physical input port, data associated with network traffic content, execute one or more instructions based on the one or more signatures and the data, determine whether a portion of the network traffic content matches the content desired to be detected, when a portion of the network traffic content is determined to match content desired to be detected, perform at least one remedial action including removal of the matching portion of the network traffic content, and retransmit, via the physical output port, the network traffic content;
• and
• a compiler connected to the memory, the compiler configured to translate the one or more signatures, received via the first input port, into a machine language;
• wherein:
• the first physical input port receives the signatures of content desired to be detected via a network other than the first and second networks;
• and
• the first and second physical input ports and the physical output port are each wire-based network ports.

A device for detecting network traffic content, the device comprising:

• a first physical input port to receive signatures;
• a second physical input port to receive, over a first network, network traffic content;
• a memory configured for storing one or more signatures received via the first physical input port, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
• a processor configured to receive, via the second physical input port, data associated with network traffic content, execute one or more instructions based on the one or more signatures and the data, and determine whether a portion of the network traffic content matches the content desired to be detected, perform at least one remedial action including removal of the matching portion of the network traffic content, and retransmit the network traffic content;
• and
• a physical output port coupled to the processor for transmitting, over a second network, data to a user;
• wherein;
• the first physical input port receives the signatures of content desired to be detected via a network other than the first and second networks;
• and
• the first and second physical input ports and the physical output port are each wire-based network ports.

A device for detecting network traffic content, the device comprising:

• a first physical input port to receive signatures associated with content desired to be detected;
• a second physical input port to receive, over a first network, data associated with network traffic content;
• a physical output port to retransmit, over a second network, processed network traffic content;
• a memory configured for storing one or more signatures received via the first physical input port, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
• a processor configured to receive, via the second physical input port, data associated with network traffic content, execute one or more instructions based on the one or more signatures and the data, and determine whether a portion of the network traffic content matches the content desired to be detected perform at least one remedial action including removal of the matching portion of the network traffic content, and retransmit the network traffic content via the physical output port;
• and
• a network traffic flow management module for managing flow of the network traffic, wherein the network traffic flow management module includes a protocol differentiator for routing the network traffic content based on a protocol of the network traffic content;
• wherein;
• the first physical input port receives the signatures of content desired to be detected via a network other than the first and second networks;
• and
• the first and second physical input ports and the physical output port are each wire-based network ports.

A method for detecting network traffic content, the method comprising:

• receiving, over a first network by a first physical input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
• receiving, over a second network by a second physical input port, data associated with network traffic content;
• executing one or more instructions based on the one or more predicates and the data;
• determining whether a portion of the network traffic content matches the content desired to be detected;
• performing at least one remedial action including removal of the matching portion of the network traffic content;
• and
• retransmitting, over a third network via a physical output port, the network traffic content;
• wherein:
• the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures of content desired to be detected;
• the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content;
• and
• the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.

A method for detecting network traffic content, the method comprising:

• receiving, over a first network by a first physical input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
• receiving, over a second network by a second physical input port, data associated with network traffic content;
• executing one or more instructions based on the one or more predicates and the data;
• determining whether a portion of the network traffic content matches the content desired to be detected;
• performing at least one remedial action including removal of the matching portion of the network traffic content;
• and
• retransmitting, over a third network via a physical output port, the network traffic content;
• wherein each of the one or more signatures includes an argument associated with one of the one or more predicates;
• wherein:
• the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures;
• the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content;
• and
• the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.

A method for detecting network traffic content, the method comprising:

• receiving, over a first network by a first physical input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
• receiving, over a second network by a second physical input port, data associated with network traffic content;
• executing one or more instructions based on the one or more predicates and the data;
• determining whether a portion of the network traffic content matches the content desired to be detected;
• performing at least one remedial action including removal of the matching portion of the network traffic content;
• and
• retransmitting, over a third network via a physical output port, the network traffic content;
• and
• compiling the one or more signatures into a machine language;
• wherein:
• the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures;
• the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content;
• and
• the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.

A method for detecting network traffic content, the method comprising:

• receiving, over a first network by a first physical input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
• receiving, over a second network by a second physical input port, data associated with network traffic content;
• executing one or more instructions based on the one or more predicates and the data;
• determining whether a portion of the network traffic content matches the content desired to be detected;
• and
• managing a flow of the network traffic content including performing at least one remedial action including removal the matching portion of the network traffic and retransmitting, over a third network via a physical output port, the network traffic content;
• wherein the managing comprises scanning the data to determine a protocol of the network traffic content, wherein the executing is performed when the determined protocol of the network traffic content matches a protocol of network traffic content that could contain the content desired to be detected;
• wherein:
• the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures;
• the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content;
• and
• the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.

A method for detecting network traffic content, the method comprising:

• receiving, over a first network by a first physical input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
• receiving, over a second network by a second physical input port, data associated with network traffic content;
• executing one or more instructions based on the one or more predicates and the data;
• determining whether a portion of the network traffic content matches the content desired to be detected;
• and
• preventing the matching portion of the network traffic content from being sent, over a third network via a physical output port, to a user when the network traffic content matches the content desired to be detected;
• wherein:
• the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures;
• the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content;
• and
• the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.

A non-transitory computer readable storage medium having a set of instructions stored thereon, the execution of which by a processor causes a process to be performed, the process comprising:

• receiving, over a first network by a physical first input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
• receiving, over a second network by a physical second input port, data associated with network traffic content;
• executing one or more instructions based on the one or more predicates and the data;
• determining whether a portion of the network traffic content matches the content desired to be detected;
• performing at least one remedial action including removal of the matching portion of the network traffic content;
• and
• retransmitting, over a third network via a physical output port, the network traffic content;
• wherein:
• the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures;
• the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content;
• and
• the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.

A non-transitory computer readable storage medium having a set of instructions stored thereon, the execution of which by a processor causes a process to be performed, the process comprising:

• receiving, over a first network by a first physical input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
• receiving, over a second network by a second physical input port, data associated with network traffic content;
• executing one or more instructions based on the one or more predicates and the data;
• determining whether a portion of the network traffic content matches the content desired to be detected;
• performing at least one remedial action including removal of the matching portion of the network traffic content;
• and
• retransmitting, over a third network via a physical output port, the network traffic content;
• wherein:
• each of the one or more signatures includes an argument associated with one of the one or more predicates;
• the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures;
• the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content;
• and
• the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.

A non-transitory computer readable storage medium having a set of instructions stored thereon, the execution of which by a processor causes a process to be performed, the process comprising:

• receiving, over a first network by a first physical input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
• receiving, over a second network by a second physical input port, data associated with network traffic content;
• executing one or more instructions based on the one or more predicates and the data;
• determining whether a portion of the network traffic content matches the content desired to be detected;
• and
• managing a flow of the network traffic content including performing at least one remedial action including removal the matching portion of the network traffic and retransmitting, over a third network via a physical output port, the network traffic content;
• wherein:
• the managing comprises scanning the data to determine a protocol of the network traffic content, wherein the executing is performed when the determined protocol of the network traffic content matches a protocol of network traffic content that could contain the content desired to be detected;
• the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures;
• the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content;
• the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.