公开(公告)号：US08621621B1

公开(公告)日：2013-12-31

申请号：US13333358

申请日：2011-12-21

申请人： Bryan Burns ,  Alex Waterman

发明人： Bryan Burns ,  Alex Waterman

IPC分类号： G06F12/14

CPC分类号： H04L63/145 ,  G06F21/54 ,  G06F21/568 ,  H04L63/1416

摘要： A computing device may receive content from a content source. The content may include software code that is executable by a web browser, and may be directed to another computing device. The computing device may inject security content into the content. The security content may include software instructions to enable the web browser to detect malicious software content within the content. The computing device may communicate the content to the other computing device.

公开(公告)号：US08261352B2

公开(公告)日：2012-09-04

申请号：US12468454

申请日：2009-05-19

申请人： Qingming Ma ,  Bryan Burns ,  Sheng Li ,  Na Liu ,  Xuejun Wu ,  Shan Yu ,  Li Zheng

发明人： Qingming Ma ,  Bryan Burns ,  Sheng Li ,  Na Liu ,  Xuejun Wu ,  Shan Yu ,  Li Zheng

IPC分类号： G06F21/06

CPC分类号： H04L63/1416

摘要： A method includes receiving a data unit, determining whether a current state, associated with a deterministic finite automata (DFA) that includes a portion of states in a bitmap and a remaining portion of states in a DFA table, is a bitmap state or not, and determining whether a value corresponding to the data unit is greater than a threshold value, when it is determined that the current state is not a bitmap state. The method further includes determining whether the current state is insensitive, when it is determined that the value corresponding to the data unit is greater than the threshold value, where insensitive means that each next state is a same state for the current state, and selecting a default state, as a next state for the current, when it is determined that the current state is insensitive.

摘要翻译： 一种方法包括接收数据单元，确定与包括位图中的状态的一部分和DFA表中的剩余部分状态的确定性有限自动机（DFA）相关联的当前状态是否为位图状态， 以及当确定当前状态不是位图状态时，确定对应于所述数据单元的值是否大于阈值。 该方法还包括当确定对应于数据单元的值大于阈值时确定当前状态是否不敏感，其中不确定意味着每个下一状态对于当前状态是相同的状态，并且选择 默认状态，作为当前的下一状态，当确定当前状态不敏感时。

公开(公告)号：US20080263665A1

公开(公告)日：2008-10-23

申请号：US11738059

申请日：2007-04-20

申请人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Vipin Rawat ,  Michael Chuong Shieh

发明人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Vipin Rawat ,  Michael Chuong Shieh

IPC分类号： G06F11/00

CPC分类号： H04L63/1416 ,  G06F21/552 ,  G06F21/74 ,  G06F21/76 ,  G06F2221/2105 ,  H04L63/0227

摘要： This disclosure describes techniques for determining whether network traffic contains one or more computer security threats. In order to determine whether a symbol stream conforms to the symbol pattern, a security device stores a full deterministic finite automaton (fDFA) that accepts streams of symbols that conform to the symbol pattern. The security device also creates a partial deterministic finite automaton (pDFA) that includes nodes that correspond to the nodes in the fDFA that have the highest visitation levels. The security device processes each symbol in the symbol stream using the pDFA until a symbol causes the pDFA to transition to a failure node or to an accepting node. If the symbol causes the pDFA to transition to the failure node, the security device processes the symbol and subsequent symbols in the symbol stream using the fDFA.

摘要翻译： 本公开描述了用于确定网络流量是否包含一个或多个计算机安全威胁的技术。 为了确定符号流是否符合符号模式，安全设备存储接受符合符号模式的符号流的完全确定性有限自动机（fDFA）。 安全设备还创建一个部分确定性有限自动机（pDFA），其中包含与fDFA中具有最高访问级别的节点相对应的节点。 安全设备使用pDFA处理符号流中的每个符号，直到符号导致pDFA转换到故障节点或接受节点。 如果符号导致pDFA转换到故障节点，则安全设备使用fDFA处理符号流中的符号和后续符号。

公开(公告)号：US20080101234A1

公开(公告)日：2008-05-01

申请号：US11589645

申请日：2006-10-30

申请人： Harshad Nakil ,  Bryan Burns ,  Ankur Singla

发明人： Harshad Nakil ,  Bryan Burns ,  Ankur Singla

IPC分类号： H04J1/16

CPC分类号： H04L63/1425

摘要： In general, the invention is directed to techniques of identifying an infected network device in a computer network where traffic to and from the infected network device is not necessarily routed through a single point on the computer network. For example, individual line cards in network devices count incoming network flows from network devices in host tables. The host tables of all line cards of all participating network devices are then correlated. It is then determined whether the number of flows from a network device outweighs the number of flows to the network device to a significant degree. If so, the network device may be considered suspicious. Packets from a suspicious network device may be rerouted to a network security device for more thorough inspection.

摘要翻译： 通常，本发明涉及识别计算机网络中感染的网络设备的技术，其中来往和来自被感染的网络设备的流量不一定通过计算机网络上的单个点路由。 例如，网络设备中的各个线路卡从主机表中的网络设备计数传入的网络流。 然后，所有参与的网络设备的所有线路卡的主机表相关。 然后确定来自网络设备的流量是否大大超过了到网络设备的流量的数量。 如果是这样，网络设备可能被认为是可疑的。 来自可疑网络设备的数据包可能会重新路由到网络安全设备以进行更全面的检查。

公开(公告)号：US09083740B1

公开(公告)日：2015-07-14

申请号：US12568319

申请日：2009-09-28

申请人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Li Zheng

发明人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Li Zheng

IPC分类号： H04L29/06 ,  G06F17/30

CPC分类号： H04L63/145 ,  G06F17/30985 ,  H04L63/0227 ,  H04L63/1408

摘要： In general, techniques are described for network traffic pattern matching using adaptive deterministic finite automata (DFA). A network device may implement the techniques to promote pattern matching. The network device comprises a control unit that stores first and second data defining first and second portions of a DFA, respectively. The first data defines first states of the DFA in an uncompressed format. The second data defines second states of the DFA in a compressed format. The network device also includes an interface that receives network packets. The control unit processes the network packets to traverse the first and second states. The control unit then compares a number of times the first and second states have been traversed. Based on the comparison, the control unit dynamically reallocates the first states of the DFA in the uncompressed format and the second states of the DFA in the compressed format.

摘要翻译： 一般来说，描述了使用自适应确定性有限自动机（DFA）进行网络流量模式匹配的技术。 网络设备可以实现促进模式匹配的技术。 网络设备包括分别存储定义DFA的第一和第二部分的第一和第二数据的控制单元。 第一个数据以未压缩格式定义了DFA的第一个状态。 第二个数据以压缩格式定义了DFA的第二个状态。 网络设备还包括接收网络分组的接口。 控制单元处理网络分组以遍历第一和第二状态。 然后，控制单元比较遍历第一和第二状态的次数。 基于比较，控制单元以未压缩格式动态地重新分配DFA的第一状态，并以压缩格式动态重新分配DFA的第二状态。

公开(公告)号：US08789173B2

公开(公告)日：2014-07-22

申请号：US12607107

申请日：2009-10-28

申请人： Krishna Narayanaswamy ,  Bryan Burns ,  Venkata Rama Raju Manthena

发明人： Krishna Narayanaswamy ,  Bryan Burns ,  Venkata Rama Raju Manthena

IPC分类号： H04L9/00 ,  H04L29/08

CPC分类号： H04L63/1458 ,  H04L63/1416

摘要： A network security device performs a three-stage analysis of traffic to identify malicious clients. In one example, a device includes an attack detection module to, during a first stage, monitor network connections to a protected network device, during a second stage, to monitor a plurality of types of transactions for the plurality of network sessions when a parameter for the connections exceeds a connection threshold, and during a third stage, to monitor communications associated with network addresses from which transactions of the at least one of type of transactions originate when a parameter associated with the at least one type of transactions exceeds a transaction-type threshold. The device executes a programmed action with respect to at least one of the network addresses when the transactions of the at least one of the plurality of types of transactions originating from the at least one network address exceeds a client-transaction threshold.

摘要翻译： 网络安全设备对流量执行三阶段分析，以识别恶意客户端。 在一个示例中，设备包括攻击检测模块，在第一阶段期间，在第二阶段期间，监视与受保护网络设备的网络连接，以监视多个网络会话的多种类型的事务，当用于 所述连接超过连接阈值，并且在第三阶段期间，当与所述至少一种类型的事务相关联的参数超过事务类型时，监视与所述至少一种类型的事务的事务起始的网络地址相关联的通信 阈。 当来自所述至少一个网络地址的所述多种类型的交易中的至少一种交易的交易超过客户端交易阈值时，所述设备相对于所述网络地址中的至少一个执行编程动作。

公开(公告)号：US07864764B1

公开(公告)日：2011-01-04

申请号：US12211371

申请日：2008-09-16

申请人： Qingming Ma ,  Bryan Burns ,  Xianzhi Li ,  Krishna Narayanaswamy

发明人： Qingming Ma ,  Bryan Burns ,  Xianzhi Li ,  Krishna Narayanaswamy

IPC分类号： H04L12/56 ,  H04L12/28 ,  H04L12/54

CPC分类号： H04L67/2847 ,  H04L12/413 ,  H04L69/22

摘要： In general, techniques are described for reducing response times to retrieve content in an intermediate network device. In particular, the intermediate network device receives a packet from a client device of a first network that requests content from a remote network device of a second network, inspects the packet to determine whether the requested content has been previously cached to either of a first and a second memory of the device, issues a request to load the requested content from the second memory to the first memory based on the determination and queues the packet within in the queue. After queuing the packet, the intermediate network device then processes the packet to assemble a response that includes the content from the memory.

摘要翻译： 通常，描述了用于减少在中间网络设备中检索内容的响应时间的技术。 特别地，中间网络设备从第一网络的客户端设备接收来自第二网络的远程网络设备的内容的分组，检查分组以确定所请求的内容是否先前已被缓存到第一和第 所述设备的第二存储器基于所述确定发出请求以将所请求的内容从所述第二存储器加载到所述第一存储器，并且对所述队列内的所述分组进行排队。 在对数据包进行排队之后，中间网络设备然后处理分组以组合包含来自存储器的内容的响应。

公开(公告)号：US20100229238A1

公开(公告)日：2010-09-09

申请号：US12468454

申请日：2009-05-19

申请人： Qingming Ma ,  Bryan Burns ,  Sheng Li ,  Na Liu ,  Xuejun Wu ,  Shan Yu ,  Li Zheng

发明人： Qingming Ma ,  Bryan Burns ,  Sheng Li ,  Na Liu ,  Xuejun Wu ,  Shan Yu ,  Li Zheng

IPC分类号： G06F21/06

CPC分类号： H04L63/1416

摘要： A method includes receiving a data unit, determining whether a current state, associated with a deterministic finite automata (DFA) that includes a portion of states in a bitmap and a remaining portion of states in a DFA table, is a bitmap state or not, and determining whether a value corresponding to the data unit is greater than a threshold value, when it is determined that the current state is not a bitmap state. The method further includes determining whether the current state is insensitive, when it is determined that the value corresponding to the data unit is greater than the threshold value, where insensitive means that each next state is a same state for the current state, and selecting a default state, as a next state for the current, when it is determined that the current state is insensitive.

摘要翻译： 一种方法包括接收数据单元，确定与包括位图中的状态的一部分和DFA表中的剩余部分状态的确定性有限自动机（DFA）相关联的当前状态是否为位图状态， 以及当确定当前状态不是位图状态时，确定对应于所述数据单元的值是否大于阈值。 该方法还包括当确定对应于数据单元的值大于阈值时确定当前状态是否不敏感，其中不确定意味着每个下一状态对于当前状态是相同的状态，并且选择 默认状态，作为当前的下一状态，当确定当前状态不敏感时。

公开(公告)号：US20100192225A1

公开(公告)日：2010-07-29

申请号：US12361364

申请日：2009-01-28

申请人： Qingming Ma ,  Bryan Burns ,  Ricardo Oliveira

发明人： Qingming Ma ,  Bryan Burns ,  Ricardo Oliveira

IPC分类号： G06F21/00 ,  G06N5/02 ,  G06F15/18 ,  G06F15/16

CPC分类号： H04L63/0227 ,  G06F16/90344 ,  G06F21/552 ,  H04L63/1416

摘要： In general, techniques are described for efficiently implementing application identification within network devices. In particular, a network device includes a control unit that stores data defining a group Deterministic Finite Automata (DFA) and an individual DFA. The group DFA is formed by merging non-explosive DFAs generated from corresponding non-explosive regular expressions (regexs) and fingerprint DFAs (f-DFAs) generated from signature fingerprints extracted from explosive regexs. The non-explosive regexs comprise regexs determined not to cause state explosion during generation of the group DFA, the signature fingerprints comprise segments of explosive regexs that uniquely identifies the explosive regexs, and the explosive regexs comprise regexs determined to cause state explosion during generation of the group DFA. The network device includes an interface that receives a packet and the control unit traverses first the group DFA and then, in some instances, the individual DFAs to more efficiently identify network applications to which packets correspond.

摘要翻译： 通常，描述了用于在网络设备内有效实现应用识别的技术。 特别地，网络设备包括控制单元，其存储定义组确定性有限自动机（DFA）和单个DFA的数据。 组DFA是通过合并从相应的非爆炸正则表达式（正则表达式）生成的非爆炸性DFA和由从爆炸正则表达式提取的签名指纹生成的指纹DFA（f-DFA）而形成的。 非爆炸式正则表达式包括在组DFA生成期间确定不会导致状态爆炸的正则表达式，签名指纹包含唯一识别爆炸正则表达式的爆炸正则表达式的部分，并且爆炸正则表达式包括被确定为在生成期间导致状态爆炸的正则表达式 组DFA。 网络设备包括接收分组的接口，并且控制单元首先遍历组DFA，然后在某些情况下遍历各个DFA以更有效地识别分组对应的网络应用。

公开(公告)号：US08914878B2

公开(公告)日：2014-12-16

申请号：US12432325

申请日：2009-04-29

申请人： Bryan Burns ,  Krishna Narayanaswamy

发明人： Bryan Burns ,  Krishna Narayanaswamy

IPC分类号： H04L29/06 ,  G06F21/00

CPC分类号： H04L63/1441 ,  H04L63/14 ,  H04L63/1416 ,  H04L2463/144

摘要： This disclosure describes techniques for determining whether a network session originates from an automated software agent. In one example, a network device, such as a router, includes a network interface to receive packets of a network session, a bot detection module to calculate a plurality of scores for network session data based on a plurality of metrics, wherein each of the metrics corresponds to a characteristic of a network session originated by an automated software agent, to produce an aggregate score from an aggregate of the plurality of scores, and to determine that the network session is originated by an automated software agent when the aggregate score exceeds a threshold, and an attack detection module to perform a programmed response when the network session is determined to be originated by an automated software agent. Each score represents a likelihood that the network session is originated by an automated software agent.

摘要翻译： 本公开描述了用于确定网络会话是否源于自动化软件代理的技术。 在一个示例中，诸如路由器的网络设备包括用于接收网络会话的分组的网络接口，基于多个度量来计算网络会话数据的多个分数的机器人检测模块，其中， 度量对应于由自动化软件代理发起的网络会话的特征，以从多个分数的聚合中产生聚合分数，并且当聚合分数超过一个分数时，确定网络会话由自动软件代理发起 阈值，以及当网络会话被确定为由自动化软件代理发起时执行编程响应的攻击检测模块。 每个分数表示网络会话由自动化软件代理发起的可能性。