Methods and apparatus providing automatic signature generation and enforcement
AssigneeCisco Technology, Inc.
InventorsJeffrey A. Kraemer, Andrew Zawadowskiy, Philip J. S. Gladstone
Life of this patent
Estimating the term…
Abstract
A system inserts at least one notifying identifier in the computer system. The at least one notifying identifier provides execution information associated with the computer system. The system receives execution information from the at least one notifying identifier, the execution information identifies details associated with a traffic flow on the computer system. The system then generates a signature based on a deterministic link provided by the execution information provided by the at least one notifying identifier. The signature is utilized to prevent further damage caused to the computer system by at least one attack.
Claims19
A method of providing computer security on a computer system, the method comprising:
- inserting at least one notifying identifier in at least one computer system, the at least one notifying identifier providing execution information associated with the at least one computer system;
- receiving execution information from the at least one notifying identifier, the execution information identifying details associated with a traffic flow comprising a plurality of data flows on the at least one computer system;
- generating a signature by matching the signature against at least a portion of a data payload associated with at least one attack;
- identifying a common sub-string from the plurality of data payloads on the at least one computer system;
- and
- refining the signature based on the common sub-string identified from the plurality of data payloads on the at least one computer system, the refined signature utilized to prevent further damage caused to the at least one computer system by the at least one attack.
A computerized device comprising:
- a memory;
- a processor;
- a communications interface;
- an interconnection mechanism coupling the memory, the processor and the communications interface;
- wherein the memory is encoded with a signature generating application that when executed on the processor is capable of providing computer security on the computerized device by performing the operations of:
- inserting at least one notifying identifier in at least one computer system, the at least one notifying identifier providing execution information associated with the at least one computer system;
- receiving execution information from the at least one notifying identifier, the execution information identifying details associated with a traffic flow comprising a plurality of data flows on the at least one computer system;
- generating a signature by matching the signature against at least a portion of a data payload associated with at least one attack;
- identifying a common sub-string from the plurality of data payloads on the at least one computer system;
- and
- refining the signature based on the common sub-string identified from the plurality of data payloads on the at least one computer system, the refined signature utilized to prevent further damage caused to the at least one computer system by the at least one attack.
A non-transitory computer readable medium encoded with computer programming logic that when executed on a process in a computerized device provides computer security, the medium comprising:
- instructions for inserting at least one notifying identifier in at least one computer system, the at least one notifying identifier providing execution information associated with the at least one computer system;
- instructions for receiving execution information from the at least one notifying identifier, the execution information identifying details associated with a traffic flow comprising a plurality of data flows on the at least one computer system;
- instructions for generating a signature by matching the signature against at least a portion of a data payload associated with at least one attack;
- instructions for identifying a common sub-string from the plurality of data payloads on the at least one computer system;
- and
- instructions for refining the signature based on a the common sub-string identified from the plurality of data payloads on the at least one computer system, the refined signature utilized to prevent further damage caused to the at least one computer system by the at least one attack.
Dependencies are inferred from the claim text.