# US 8,789,183 B1 · Detecting network traffic content

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,789,183 B1
- Document ID: US8789183B1
- Status: Granted
- Kind: B1
- Application number: 10/624,948
- Filed: 2003-07-21
- Granted: 2014-07-22
- Earliest claimed: 2002-07-19
- Assignees: Fortinet, Inc.
- Applicants: Michael Xie
- Inventors: Michael Xie
- Web page: https://patentgrep.com/patent/US8789183B1

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L 43/04: Processing captured monitoring data, e.g. for logfile generation
- H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/0245: {Filtering by information in the payload}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A device for detecting network traffic content is provided. The device includes a memory configured for storing one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates. The device also includes a processor configured to receive data associated with network traffic content, execute one or more instructions based on the one or more signatures and the data, and determine whether the network traffic content matches the content desired to be detected.

## Claims

### Claim 1

A device for detecting network traffic content, the device comprising:
a first physical input port to receive signatures of content desired to be detected;
a second physical input port to receive, over a first network, network traffic content;
a physical output port to retransmit, over a second network, processed network traffic content;
a memory configured for storing one or more signatures received via the first physical input port, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content; and
a processor configured to
receive, via the second physical input port, data associated with network traffic content,
execute one or more instructions based on the one or more signatures and the data,
determine whether a portion of the network traffic content matches the content desired to be detected;
when a portion of the network traffic content is determined to match content desired to be detected, perform at least one remedial action including removal of the matching portion of the network traffic content; and
retransmit, via the physical output port, the network traffic content;
wherein:
the first physical input port receives the signatures of content desired to be detected via a network other than the first and second networks; and
the first and second physical input ports and the physical output port are each wire-based network ports.

### Claim 2

A device for detecting network traffic content, the device comprising:
a first physical input port to receive signatures of content desired to be detected;
a second physical input port to receive, over a first network, network traffic content;
a physical output port to retransmit, over a second network, processed network traffic content;
a memory configured for storing one or more signatures received via the first physical input port, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
a processor configured to receive, via the second physical input port, data associated with network traffic content, execute one or more instructions based on the one or more signatures and the data, determine whether a portion of the network traffic content matches the content desired to be detected, when a portion of the network traffic content is determined to match content desired to be detected, perform at least one remedial action including removal of the matching portion of the network traffic content, and retransmit, via the physical output port, the network traffic content; and
a compiler connected to the memory, the compiler configured to translate the one or more signatures, received via the first input port, into a machine language;
wherein:
the first physical input port receives the signatures of content desired to be detected via a network other than the first and second networks; and
the first and second physical input ports and the physical output port are each wire-based network ports.

### Claim 3 (depends on 2)

The device of claim 2, wherein the processor comprises a general purpose processor.

### Claim 4 (depends on 2)

The device of claim 2, wherein the processor comprises an ASIC processor.

### Claim 5 (depends on 4)

The device of claim 4, wherein the ASIC processor is a semi-custom ASIC processor.

### Claim 6 (depends on 4)

The device of claim 4, wherein the ASIC processor is a programmable ASIC processor.

### Claim 7 (depends on 2)

The device of claim 2, wherein one or both of the memory and the processor are associated with a firewall.

### Claim 8

A device for detecting network traffic content, the device comprising:
a first physical input port to receive signatures;
a second physical input port to receive, over a first network, network traffic content;
a memory configured for storing one or more signatures received via the first physical input port, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
a processor configured to receive, via the second physical input port, data associated with network traffic content, execute one or more instructions based on the one or more signatures and the data, and determine whether a portion of the network traffic content matches the content desired to be detected, perform at least one remedial action including removal of the matching portion of the network traffic content, and retransmit the network traffic content; and
a physical output port coupled to the processor for transmitting, over a second network, data to a user;
wherein;
the first physical input port receives the signatures of content desired to be detected via a network other than the first and second networks; and
the first and second physical input ports and the physical output port are each wire-based network ports.

### Claim 9 (depends on 7)

The device of claim 7, wherein the content desired to be detected comprises a malicious code.

### Claim 10 (depends on 7)

The device of claim 7, wherein the content desired to be detected is selected from the group consisting of a virus, a worm, a web content, a Trojan agent, an email spam, and a packet sent by a hacker.

### Claim 11 (depends on 7)

The device of claim 7, further comprising a buffer for storing the network traffic content before the network traffic content is processed by the processor.

### Claim 12 (depends on 7)

The device of claim 7, further comprising a network traffic flow management module for managing flow of the network traffic.

### Claim 13

A device for detecting network traffic content, the device comprising:
a first physical input port to receive signatures associated with content desired to be detected;
a second physical input port to receive, over a first network, data associated with network traffic content;
a physical output port to retransmit, over a second network, processed network traffic content;
a memory configured for storing one or more signatures received via the first physical input port, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
a processor configured to receive, via the second physical input port, data associated with network traffic content, execute one or more instructions based on the one or more signatures and the data, and determine whether a portion of the network traffic content matches the content desired to be detected perform at least one remedial action including removal of the matching portion of the network traffic content, and retransmit the network traffic content via the physical output port; and
a network traffic flow management module for managing flow of the network traffic, wherein the network traffic flow management module includes a protocol differentiator for routing the network traffic content based on a protocol of the network traffic content;
wherein;
the first physical input port receives the signatures of content desired to be detected via a network other than the first and second networks; and
the first and second physical input ports and the physical output port are each wire-based network ports.

### Claim 14 (depends on 13)

The device of claim 13, further comprising a stack for receiving packets associated with the network traffic content from the protocol differentiator, and sending the packets to the processor.

### Claim 15 (depends on 14)

The device of claim 14, wherein the protocol differentiator is configured to route the network traffic content to the stack when it is determined that the network traffic content may contain content desired to be detected.

### Claim 16 (depends on 13)

The device of claim 13, further comprising a packet processing module for receiving packets associated with the network traffic content from the protocol differentiator.

### Claim 17 (depends on 16)

The device of claim 16, wherein the protocol differentiator is configured to route the network traffic content to the packet processing module when it is determined that the network traffic content is not of a type that may contain content desired to be detected.

### Claim 18 (depends on 7)

The device of claim 7, wherein the processor is further configured to cause a message to be sent to a user when the network traffic content matches the content desired to be detected.

### Claim 19

A method for detecting network traffic content, the method comprising:
receiving, over a first network by a first physical input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
receiving, over a second network by a second physical input port, data associated with network traffic content;
executing one or more instructions based on the one or more predicates and the data;
determining whether a portion of the network traffic content matches the content desired to be detected;
performing at least one remedial action including removal of the matching portion of the network traffic content; and
retransmitting, over a third network via a physical output port, the network traffic content;
wherein:
the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures of content desired to be detected;
the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content; and
the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.

### Claim 20

A method for detecting network traffic content, the method comprising:
receiving, over a first network by a first physical input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
receiving, over a second network by a second physical input port, data associated with network traffic content;
executing one or more instructions based on the one or more predicates and the data;
determining whether a portion of the network traffic content matches the content desired to be detected;
performing at least one remedial action including removal of the matching portion of the network traffic content; and
retransmitting, over a third network via a physical output port, the network traffic content;
wherein each of the one or more signatures includes an argument associated with one of the one or more predicates;
wherein:
the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures;
the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content; and
the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.

### Claim 21 (depends on 19)

The method of claim 19, wherein the executing is performed using a general purpose processor.

### Claim 22 (depends on 19)

The method of claim 19, wherein the executing is performed using an ASIC processor.

### Claim 23 (depends on 19)

The method of claim 19, wherein the content desired to be detected comprises a malicious code.

### Claim 24 (depends on 19)

The method of claim 19, wherein the content desired to be detected is selected from the group consisting of a virus, a worm, a web content, a Trojan agent, an email spam, and a packet sent by a hacker.

### Claim 25

A method for detecting network traffic content, the method comprising:
receiving, over a first network by a first physical input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
receiving, over a second network by a second physical input port, data associated with network traffic content;
executing one or more instructions based on the one or more predicates and the data;
determining whether a portion of the network traffic content matches the content desired to be detected;
performing at least one remedial action including removal of the matching portion of the network traffic content; and
retransmitting, over a third network via a physical output port, the network traffic content; and
compiling the one or more signatures into a machine language;
wherein:
the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures;
the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content; and
the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.

### Claim 26 (depends on 19)

The method of claim 19, further comprising managing a flow of the network traffic content.

### Claim 27

A method for detecting network traffic content, the method comprising:
receiving, over a first network by a first physical input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
receiving, over a second network by a second physical input port, data associated with network traffic content;
executing one or more instructions based on the one or more predicates and the data;
determining whether a portion of the network traffic content matches the content desired to be detected; and
managing a flow of the network traffic content including performing at least one remedial action including removal the matching portion of the network traffic and retransmitting, over a third network via a physical output port, the network traffic content;
wherein the managing comprises scanning the data to determine a protocol of the network traffic content, wherein the executing is performed when the determined protocol of the network traffic content matches a protocol of network traffic content that could contain the content desired to be detected;
wherein:
the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures;
the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content; and
the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.

### Claim 28 (depends on 19)

The method of claim 19, further comprising storing the one or more signatures.

### Claim 29

A method for detecting network traffic content, the method comprising:
receiving, over a first network by a first physical input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
receiving, over a second network by a second physical input port, data associated with network traffic content;
executing one or more instructions based on the one or more predicates and the data;
determining whether a portion of the network traffic content matches the content desired to be detected; and
preventing the matching portion of the network traffic content from being sent, over a third network via a physical output port, to a user when the network traffic content matches the content desired to be detected;
wherein:
the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures;
the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content; and
the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.

### Claim 30

A non-transitory computer readable storage medium having a set of instructions stored thereon, the execution of which by a processor causes a process to be performed, the process comprising:
receiving, over a first network by a physical first input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
receiving, over a second network by a physical second input port, data associated with network traffic content;
executing one or more instructions based on the one or more predicates and the data;
determining whether a portion of the network traffic content matches the content desired to be detected;
performing at least one remedial action including removal of the matching portion of the network traffic content; and
retransmitting, over a third network via a physical output port, the network traffic content;
wherein:
the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures;
the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content; and
the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.

### Claim 31

A non-transitory computer readable storage medium having a set of instructions stored thereon, the execution of which by a processor causes a process to be performed, the process comprising:
receiving, over a first network by a first physical input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
receiving, over a second network by a second physical input port, data associated with network traffic content;
executing one or more instructions based on the one or more predicates and the data;
determining whether a portion of the network traffic content matches the content desired to be detected;
performing at least one remedial action including removal of the matching portion of the network traffic content; and
retransmitting, over a third network via a physical output port, the network traffic content;
wherein:
each of the one or more signatures includes an argument associated with one of the one or more predicates;
the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures;
the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content; and
the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.

### Claim 32 (depends on 30)

The non-transitory computer readable storage medium of claim 30, wherein the executing is performed using a general purpose processor.

### Claim 33 (depends on 30)

The non-transitory computer readable storage medium of claim 30, wherein the executing is performed using an ASIC processor.

### Claim 34 (depends on 30)

The non-transitory computer readable storage medium of claim 30, wherein the content desired to be detected comprises a malicious code.

### Claim 35 (depends on 30)

The non-transitory computer readable storage medium of claim 30, wherein the content desired to be detected is selected from the group consisting of a virus, a worm, a web content, a Trojan agent, an email spam, and a packet transmitted by a hacker.

### Claim 36 (depends on 30)

The non-transitory computer readable storage medium of claim 30, wherein the process further comprising compiling the one or more signatures.

### Claim 37 (depends on 30)

The non-transitory computer readable storage medium of claim 30, wherein the process further comprising managing a flow of the network traffic content.

### Claim 38

A non-transitory computer readable storage medium having a set of instructions stored thereon, the execution of which by a processor causes a process to be performed, the process comprising:
receiving, over a first network by a first physical input port, one or more signatures, each of the one or more signatures associated with content desired to be detected, and defined by one or more predicates each providing logic for identifying particular content;
receiving, over a second network by a second physical input port, data associated with network traffic content;
executing one or more instructions based on the one or more predicates and the data;
determining whether a portion of the network traffic content matches the content desired to be detected; and
managing a flow of the network traffic content including performing at least one remedial action including removal the matching portion of the network traffic and retransmitting, over a third network via a physical output port, the network traffic content;
wherein:
the managing comprises scanning the data to determine a protocol of the network traffic content, wherein the executing is performed when the determined protocol of the network traffic content matches a protocol of network traffic content that could contain the content desired to be detected;
the first physical input port is a wire-based network port that physically couples the first physical input port to the first network and is dedicated to the receiving of the one or more signatures;
the second physical input port is a wire-based network port that physically couples the second physical input port to the second network and is dedicated to the receiving of the network traffic content;
the physical output port is a wire-based network port that physically couples the physical output port to the third network and is dedicated to the retransmitting of the network traffic content.

### Claim 39 (depends on 30)

The non-transitory computer readable storage medium of claim 30, wherein the process further comprising storing the one or more signatures.

### Claim 40 (depends on 8)

The device of claim 8, wherein one or both of the memory and the processor are associated with a firewall.

### Claim 41 (depends on 8)

The device of claim 8, wherein the processor comprises a general purpose processor.

### Claim 42 (depends on 8)

The device of claim 8, wherein the processor comprises an ASIC processor.

### Claim 43 (depends on 42)

The device of claim 42, wherein the ASIC processor is a semi-custom ASIC processor.

### Claim 44 (depends on 42)

The device of claim 42, wherein the ASIC processor is a programmable ASIC processor.

### Claim 45 (depends on 8)

The device of claim 8, wherein the content desired to be detected comprises a malicious code.

### Claim 46 (depends on 8)

The device of claim 8, wherein the content desired to be detected is selected from the group consisting of a virus, a worm, a web content, a Trojan agent, an email spam, and a packet sent by a hacker.

### Claim 47 (depends on 8)

The device of claim 8, further comprising a buffer for storing the network traffic content before the network traffic content is processed by the processor.

### Claim 48 (depends on 8)

The device of claim 8, further comprising a network traffic flow management module for managing flow of the network traffic.

### Claim 49 (depends on 8)

The device of claim 8, wherein the processor is further configured to cause a message to be sent to a user when the network traffic content matches the content desired to be detected.

### Claim 50 (depends on 13)

The device of claim 13, wherein one or both of the memory and the processor are associated with a firewall.

### Claim 51 (depends on 13)

The device of claim 13, wherein the processor comprises a general purpose processor.

### Claim 52 (depends on 13)

The device of claim 13, wherein the processor comprises an ASIC processor.

### Claim 53 (depends on 52)

The device of claim 52, wherein the ASIC processor is a semi-custom ASIC processor.

### Claim 54 (depends on 52)

The device of claim 52, wherein the ASIC processor is a programmable ASIC processor.

### Claim 55 (depends on 13)

The device of claim 13, wherein the content desired to be detected comprises a malicious code.

### Claim 56 (depends on 13)

The device of claim 13, wherein the content desired to be detected is selected from the group consisting of a virus, a worm, a web content, a Trojan agent, an email spam, and a packet sent by a hacker.

### Claim 57 (depends on 13)

The device of claim 13, further comprising a buffer for storing the network traffic content before the network traffic content is processed by the processor.

### Claim 58 (depends on 13)

The device of claim 13, wherein the processor is further configured to cause a message to be sent to a user when the network traffic content matches the content desired to be detected.

### Claim 59 (depends on 1)

The device of claim 1, further comprising a network traffic flow management module for managing flow of the network traffic.

### Claim 60 (depends on 20)

The method of claim 20, wherein the executing is performed using a general purpose processor.

### Claim 61 (depends on 20)

The method of claim 20, wherein the executing is performed using an ASIC processor.

### Claim 62 (depends on 20)

The method of claim 20, wherein the content desired to be detected comprises a malicious code.

### Claim 63 (depends on 20)

The method of claim 20, wherein the content desired to be detected is selected from the group consisting of a virus, a worm, a web content, a Trojan agent, an email spam, and a packet sent by a hacker.

### Claim 64 (depends on 25)

The method of claim 25, wherein the executing is performed using a general purpose processor.

### Claim 65 (depends on 25)

The method of claim 25, wherein the executing is performed using an ASIC processor.

### Claim 66 (depends on 25)

The method of claim 25, wherein the content desired to be detected comprises a malicious code.

### Claim 67 (depends on 25)

The method of claim 25, wherein the content desired to be detected is selected from the group consisting of a virus, a worm, a web content, a Trojan agent, an email spam, and a packet sent by a hacker.

### Claim 68 (depends on 27)

The method of claim 27, wherein the executing is performed using a general purpose processor.

### Claim 69 (depends on 27)

The method of claim 27, wherein the executing is performed using an ASIC processor.

### Claim 70 (depends on 27)

The method of claim 27, wherein the content desired to be detected comprises a malicious code.

### Claim 71 (depends on 27)

The method of claim 27, wherein the content desired to be detected is selected from the group consisting of a virus, a worm, a web content, a Trojan agent, an email spam, and a packet sent by a hacker.

### Claim 72 (depends on 29)

The method of claim 29, wherein the executing is performed using a general purpose processor.

### Claim 73 (depends on 29)

The method of claim 29, wherein the executing is performed using an ASIC processor.

### Claim 74 (depends on 29)

The method of claim 29, wherein the content desired to be detected comprises a malicious code.

### Claim 75 (depends on 29)

The method of claim 29, wherein the content desired to be detected is selected from the group consisting of a virus, a worm, a web content, a Trojan agent, an email spam, and a packet sent by a hacker.

### Claim 76 (depends on 31)

The non-transitory computer readable storage medium of claim 31, wherein the executing is performed using a general purpose processor.

### Claim 77 (depends on 31)

The non-transitory computer readable storage medium of claim 31, wherein the executing is performed using an ASIC processor.

### Claim 78 (depends on 31)

The non-transitory computer readable storage medium of claim 31, wherein the content desired to be detected comprises a malicious code.

### Claim 79 (depends on 31)

The non-transitory computer readable storage medium of claim 31, wherein the content desired to be detected is selected from the group consisting of a virus, a worm, a web content, a Trojan agent, an email spam, and a packet transmitted by a hacker.

### Claim 80 (depends on 31)

The non-transitory computer readable storage medium of claim 31, wherein the process further comprising compiling the one or more signatures.

### Claim 81 (depends on 31)

The non-transitory computer readable storage medium of claim 31, wherein the process further comprising managing a flow of the network traffic content.

### Claim 82 (depends on 31)

The non-transitory computer readable storage medium of claim 31, wherein the process further comprising storing the one or more signatures.

### Claim 83 (depends on 38)

The non-transitory computer readable storage medium of claim 38, wherein the executing is performed using a general purpose processor.

### Claim 84 (depends on 38)

The non-transitory computer readable storage medium of claim 38, wherein the executing is performed using an ASIC processor.

### Claim 85 (depends on 38)

The non-transitory computer readable storage medium of claim 38, wherein the content desired to be detected comprises a malicious code.

### Claim 86 (depends on 38)

The non-transitory computer readable storage medium of claim 38, wherein the content desired to be detected is selected from the group consisting of a virus, a worm, a web content, a Trojan agent, an email spam, and a packet transmitted by a hacker.

### Claim 87 (depends on 38)

The non-transitory computer readable storage medium of claim 38, wherein the process further comprising compiling the one or more signatures.

### Claim 88 (depends on 38)

The non-transitory computer readable storage medium of claim 38, wherein the process further comprising storing the one or more signatures.