Hardware based detection devices for detecting network traffic content and methods of using the same
원문보기
IPC분류정보
국가/구분
United States(US) Patent
등록
국제특허분류(IPC7판)
G06F-015/173
H04L-029/06
H04L-012/26
출원번호
US-0798350
(2013-03-13)
등록번호
US-8918504
(2014-12-23)
발명자
/ 주소
Xie, Michael
출원인 / 주소
Fortinet, Inc.
대리인 / 주소
Schwegman Lundberg & Woessner, P.A.
인용정보
피인용 횟수 :
3인용 특허 :
42
초록▼
A device for detecting network traffic content is provided. The device includes a first input port configured to receive one or more signatures, each of the one or more signatures associated with content desired to be detected, a second input port configured to receive data associated with network t
A device for detecting network traffic content is provided. The device includes a first input port configured to receive one or more signatures, each of the one or more signatures associated with content desired to be detected, a second input port configured to receive data associated with network traffic content. The device also includes a processor configured to process the one or more signatures and the data to determine whether the network traffic content matches the content desired to be detected, and an output port configured to couple the device to a computer system of an intended recipient of the network traffic content. The output port passes the network traffic content to the computer system when it is determined that the network traffic content does not match the content desired to be detected.
대표청구항▼
1. A method for detecting network traffic content, the method comprising: receiving one or more signatures, each of the one or more signatures associated with content desired to be detected;compiling, by a compiler process of a device that performs the method, the one or more signatures into a byte
1. A method for detecting network traffic content, the method comprising: receiving one or more signatures, each of the one or more signatures associated with content desired to be detected;compiling, by a compiler process of a device that performs the method, the one or more signatures into a byte stream executable by a processor to control operation of the processor in determining whether network traffic content matches content desired to be detected based on the compiled one or more signatures, the compiling including translating the one or more received signatures into a byte stream executable by the processor;receiving network traffic content; andprocessing the compiled one or more signatures and the network traffic content to determine whether the network traffic content matches the content desired to be detected as represented in the compiled one or more signatures;wherein: the processing is performed by a device that is a part of a firewall of a computer system;the one or more signatures are received via a first input port at the device, and the data is received via a second input port at the device, the device having a housing, the first and second input ports associated with the housing, andat least one of the one or more signatures is codified using one or more predicates which prescribe one or more functions to be executed by the processor to detect the network traffic content. 2. The method of claim 1, further comprising preventing at least a portion of the network traffic content to be sent to a user when the network traffic content matches the content desired to be detected. 3. The method of claim 1, further comprising sending a message to a user when the network traffic content matches the content desired to be detected. 4. The method of claim 1, wherein each of the first and the second input ports are externally accessible. 5. The method of claim 1, further comprising: categorizing the one or more signatures according to the one or more functions prescribed by the at least one of the one or more predicates. 6. The method of claim 1, further comprising storing the one or more signatures. 7. The method of claim 1, wherein each of the one or more signatures is codified using one or more predicates. 8. The method of claim 7, wherein each of the one or more predicates is selected from the group consisting of a letter, a word, a sentence, a number, a logical operator, a mathematical operator, and combination thereof. 9. The method of claim 1, further comprising managing a flow of the network traffic content. 10. The method of claim 9, wherein the managing comprises scanning the data to determine a protocol of the network traffic content, wherein the processing is performed when the determined protocol of the network traffic content matches with a protocol of network traffic content that could contain the content desired to be detected. 11. A non-transitory computer product includes a computer-readable medium, the computer-readable medium having a set of stored instructions, an execution of which causes a process to be performed, the process comprising: receiving one or more signatures, each of the one or more signatures associated with content desired to be detected;compiling, by a compiler process of a device that executes the process, the one or more signatures into a byte stream executable by a processor to control operation of the processor in determining whether network traffic content matches content desired to be detected based on the compiled one or more signatures, the compiling including translating the one or more received signatures into a byte stream executable by the processor;receiving network traffic content; andprocessing the compiled one or more signatures and the network traffic content to determine whether the network traffic content matches the content desired to be detected as represented in the compiled one or more signatures;wherein: the processing is performed by a device that is a part of a firewall of a computer system;the one or more signatures are received via a first input port at the device, and the data is received via a second input port at the device, the device having a housing, the first and second input ports associated with the housing, andat least one of the one or more signatures is codified using one or more predicates which prescribe one or more functions to be executed by the processor to detect the network traffic content. 12. The non-transitory computer product of claim 11, the process further comprising preventing at least a portion of the network traffic content to be sent to a user when the network traffic content matches the content desired to be detected. 13. The non-transitory computer product of claim 11, the process further comprising sending a message to a user when the network traffic content matches the content desired to be detected. 14. The non-transitory computer product of claim 11, wherein each of the first and the second input ports are externally accessible. 15. The non-transitory computer product of claim 11, the process further comprising categorizing the one or more signatures according to the one or more functions prescribed by the at least one of the one or more predicates. 16. The non-transitory computer product of claim 11, the process further comprising storing the one or more signatures. 17. The non-transitory computer product of claim 11, wherein each of the one or more signatures is codified using one or more predicates. 18. The non-transitory computer product of claim 17, wherein each of the one or more predicates is selected from the group consisting of a letter, a word, a sentence, a number, a logical operator, a mathematical operator, and combination thereof. 19. The non-transitory computer product of claim 11, the process further comprising managing a flow of the network traffic content. 20. The non-transitory computer product of claim 19, wherein the managing comprises scanning the data to determine a protocol of the network traffic content, wherein the processing is performed when the determined protocol of the network traffic content matches with a protocol of network traffic content that could contain the content desired to be detected.
연구과제 타임라인
LOADING...
LOADING...
LOADING...
LOADING...
LOADING...
이 특허에 인용된 특허 (42)
Ji Shuang ; Chen Eva ; Liang Yung-Chang ; Tsai Warren,TWX, Apparatus and method for electronic mail virus detection and elimination.
Cooper,Geoffrey; Sherlock,Kieran G.; Shaw,Bob; Valente,Luis, Automated generation of an english language representation of a formal network security policy specification.
Shtayer Ronen (Tel-Aviv ILX) Alon Naveh (Ranat Hashnron ILX) Alexander Joffe (Rehovot ILX), Method and apparatus for pacing asynchronous transfer mode (ATM) data cell transmission.
Mansfield ; Jr William H. (Pittstown NJ) Raitaz John E. (Morristown NJ), Method and system for broadcasting and querying a database using a multi-function module.
Doyle,Ronald P.; Hind,John R.; Narten,Thomas; Peters,Marcia L., Methods, systems and computer program products for detecting a spoofed source address in IP datagrams.
Keanini,Timothy D.; Quiroga,Martin A.; Buchanan,Brian W.; Flowers,John S., Network security system having a device profiler communicatively coupled to a traffic monitor.
Magdych, James S.; Rahmanovic, Tarik; McDonald, John R.; Tellier, Brock E.; Osborne, Anthony C.; Herath, Nishad P., Secure gateway for analyzing textual content to identify a harmful impact on computer systems with known vulnerabilities.
McManis Charles E. ; Yellin Frank, System and method for generating trusted, architecture specific, compiled versions of architecture neutral programs.
Ratcliff Bruce H. ; Valley Stephen R., System for checking status of supported functions of communication platforms at preselected intervals in order to allow hosts to obtain updated list of all supported functions.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.