Back to results
US 9,871,807 B2Granted
Generic protocol decoder for generic application-level protocol signatures
AssigneeMicrosoft Technology Licensing, LLC
InventorsTanmay Arun Ganacharya, Vladimir Lifliand, Evgeney Ryzhyk
Life of this patent
Estimating the term…
Abstract
Described is a generic protocol decoder that analyzes network traffic or file data to look for a signature, and signals an intrusion prevention mechanism/system if the signature is matched. In one aspect, the generic decoder is built using generic application-level protocol analysis language (GAPAL) primitives. These primitives provide various capabilities, including pattern matching, skipping, reading data, copying variable data and comparing data. The generic decoder may be coupled to a pre-developed protocol parser that provides the decoder with the data to analyze.
Claims23
A system comprising:
- at least one processor;
- a memory;
- and
- an intrusion prevention mechanism stored in the memory and including instructions, which are executable by the at least one processor and include
- an analysis engine configured to
- tokenize an input stream of data into a plurality of parts including a first one or more parts and a second one or more parts, and
- select the first one or more parts for analysis, wherein the analysis engine includes one or more protocol parsers, and wherein the one or more protocol parsers analyze the first one or more parts, and
- a generic decoder configured to operate based on generic application-level protocol analysis language primitives, wherein the generic decoder is configured to
- assist the one or more protocol parsers of the analysis engine by analyzing the second one or more parts, having a same protocol as the first one or more parts and not analyzed by the analysis engine, for a signature, wherein the analyzing of the second one or more parts includes searching the second one or more parts for a first predetermined pattern, and
- generate an error signal in response to matching the first predetermined pattern in the second one or more parts, wherein the signature is detected in response to the pattern being matched in the second one or more parts, and
- wherein the primitives include at least one of a primitive configured for pattern matching, a primitive configured for skipping a first predetermined number of bytes to search for the first predetermined pattern, a primitive configured for specifying a window in which at least one pattern is to be searched, a primitive configured for using a regular expression for pattern matching, or a primitive configured for reading a value and moving within the first one or more parts based on that value.
8 more elements
A method comprising:
- receiving content at an analysis engine;
- tokenizing the content into a plurality of parts including first parts and second parts;
- analyzing the first parts via the analysis engine;
- receiving at a generic decoder the second part the analysis engine, wherein the analysis engine includes one or more protocol parsers, and wherein the generic decoder is configured to operate based on generic application-level protocol analysis language primitives;
- analyzing, via the generic decoder, the second parts for a signature including executing code corresponding to
- at least one first generic application-level protocol analysis language primitive to skip to a location in the second parts, and
- at least one second generic application-level protocol analysis language primitive to match a pattern in the second parts,
- wherein the second parts are not analyzed by the analysis engine and have a same protocol as the first parts;
- indicating the signature is detected in response to matching the pattern in the second parts;
- and
- indicating the signature does not apply to the second parts in response to encountering a token that does not match the pattern.
8 more elements
A system comprising:
- one or more processors;
- a memory configured to store instructions, which are executable by the one or more processors and include
- an analysis engine including one or more protocol parsers and configured to receive data including a first portion and a second portion, wherein the second portion of the data has a same protocol as the first portion of the data, and wherein the analysis engine does not analyze the second portion of the data;
- and
- a generic decoder operating according to primitives, wherein the generic decoder is configured to
- receive the second portion of the data from the analysis engine,
- assist the one or more protocol parsers by analyzing the second portion of the data for a signature,
- output a signal indicating the signature is detected in response to the signature being matched to the second portion of the data;
- and
- output a signal indicating the signature does not apply to the second portion of the data in response to encountering a token that does not match the signature.
7 more elements
Dependencies are inferred from the claim text.