发明授权
- 专利标题: Methods and systems for intrusion detection
- 专利标题(中): 入侵检测方法与系统
-
申请号: US10793887申请日: 2004-03-08
-
公开(公告)号: US07305708B2公开(公告)日: 2007-12-04
- 发明人: Marc A. Norton , Daniel J. Roelker
- 申请人: Marc A. Norton , Daniel J. Roelker
- 申请人地址: US MD Columbia
- 专利权人: Sourcefire, Inc.
- 当前专利权人: Sourcefire, Inc.
- 当前专利权人地址: US MD Columbia
- 代理机构: Posz Law Group, PLC
- 主分类号: H04L9/00
- IPC分类号: H04L9/00 ; G08B23/00 ; G06F15/18
摘要:
Performance of an intrusion detection system is enhanced with the addition of rule optimization, set-based rule inspection, and protocol flow analysis. During rule optimization, rule sets are created and selected in such a way that for every incoming packet only a single rule set has to be searched. Set-based rule inspection divides rules into content and non-content type rules. Only search patterns of content type rules are initially compared to a packet. Rules containing matched search patterns are validated with a parameterized search against the packet. Matches are recorded as events. Non-content rules are searched against a packet using a parameterized search. These matches are also recorded as an event. At least one event is selected per packet for logging. Protocol flow analysis determines the direction of flow of network traffic. Based on the direction of flow and the protocol, portions of packets can be eliminated from rule inspection.
公开/授权文献
- US20040205360A1 Methods and systems for intrusion detection 公开/授权日:2004-10-14