公开(公告)号：US09083740B1

公开(公告)日：2015-07-14

申请号：US12568319

申请日：2009-09-28

申请人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Li Zheng

发明人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Li Zheng

IPC分类号： H04L29/06 ,  G06F17/30

CPC分类号： H04L63/145 ,  G06F17/30985 ,  H04L63/0227 ,  H04L63/1408

摘要： In general, techniques are described for network traffic pattern matching using adaptive deterministic finite automata (DFA). A network device may implement the techniques to promote pattern matching. The network device comprises a control unit that stores first and second data defining first and second portions of a DFA, respectively. The first data defines first states of the DFA in an uncompressed format. The second data defines second states of the DFA in a compressed format. The network device also includes an interface that receives network packets. The control unit processes the network packets to traverse the first and second states. The control unit then compares a number of times the first and second states have been traversed. Based on the comparison, the control unit dynamically reallocates the first states of the DFA in the uncompressed format and the second states of the DFA in the compressed format.

摘要翻译： 一般来说，描述了使用自适应确定性有限自动机（DFA）进行网络流量模式匹配的技术。 网络设备可以实现促进模式匹配的技术。 网络设备包括分别存储定义DFA的第一和第二部分的第一和第二数据的控制单元。 第一个数据以未压缩格式定义了DFA的第一个状态。 第二个数据以压缩格式定义了DFA的第二个状态。 网络设备还包括接收网络分组的接口。 控制单元处理网络分组以遍历第一和第二状态。 然后，控制单元比较遍历第一和第二状态的次数。 基于比较，控制单元以未压缩格式动态地重新分配DFA的第一状态，并以压缩格式动态重新分配DFA的第二状态。

公开(公告)号：US20080263665A1

公开(公告)日：2008-10-23

申请号：US11738059

申请日：2007-04-20

申请人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Vipin Rawat ,  Michael Chuong Shieh

发明人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Vipin Rawat ,  Michael Chuong Shieh

IPC分类号： G06F11/00

CPC分类号： H04L63/1416 ,  G06F21/552 ,  G06F21/74 ,  G06F21/76 ,  G06F2221/2105 ,  H04L63/0227

摘要： This disclosure describes techniques for determining whether network traffic contains one or more computer security threats. In order to determine whether a symbol stream conforms to the symbol pattern, a security device stores a full deterministic finite automaton (fDFA) that accepts streams of symbols that conform to the symbol pattern. The security device also creates a partial deterministic finite automaton (pDFA) that includes nodes that correspond to the nodes in the fDFA that have the highest visitation levels. The security device processes each symbol in the symbol stream using the pDFA until a symbol causes the pDFA to transition to a failure node or to an accepting node. If the symbol causes the pDFA to transition to the failure node, the security device processes the symbol and subsequent symbols in the symbol stream using the fDFA.

摘要翻译： 本公开描述了用于确定网络流量是否包含一个或多个计算机安全威胁的技术。 为了确定符号流是否符合符号模式，安全设备存储接受符合符号模式的符号流的完全确定性有限自动机（fDFA）。 安全设备还创建一个部分确定性有限自动机（pDFA），其中包含与fDFA中具有最高访问级别的节点相对应的节点。 安全设备使用pDFA处理符号流中的每个符号，直到符号导致pDFA转换到故障节点或接受节点。 如果符号导致pDFA转换到故障节点，则安全设备使用fDFA处理符号流中的符号和后续符号。

公开(公告)号：US07904961B2

公开(公告)日：2011-03-08

申请号：US11738059

申请日：2007-04-20

申请人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Vipin Rawat ,  Michael Chuong Shieh

发明人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Vipin Rawat ,  Michael Chuong Shieh

IPC分类号： G06F11/00

CPC分类号： H04L63/1416 ,  G06F21/552 ,  G06F21/74 ,  G06F21/76 ,  G06F2221/2105 ,  H04L63/0227

摘要： This disclosure describes techniques for determining whether network traffic contains one or more computer security threats. In order to determine whether a symbol stream conforms to the symbol pattern, a security device stores a full deterministic finite automaton (fDFA) that accepts streams of symbols that conform to the symbol pattern. The security device also creates a partial deterministic finite automaton (pDFA) that includes nodes that correspond to the nodes in the fDFA that have the highest visitation levels. The security device processes each symbol in the symbol stream using the pDFA until a symbol causes the pDFA to transition to a failure node or to an accepting node. If the symbol causes the pDFA to transition to the failure node, the security device processes the symbol and subsequent symbols in the symbol stream using the fDFA.

摘要翻译： 本公开描述了用于确定网络流量是否包含一个或多个计算机安全威胁的技术。 为了确定符号流是否符合符号模式，安全设备存储接受符合符号模式的符号流的完全确定性有限自动机（fDFA）。 安全设备还创建一个部分确定性有限自动机（pDFA），其中包含与fDFA中具有最高访问级别的节点相对应的节点。 安全设备使用pDFA处理符号流中的每个符号，直到符号导致pDFA转换到故障节点或接受节点。 如果符号导致pDFA转换到故障节点，则安全设备使用fDFA处理符号流中的符号和后续符号。

公开(公告)号：US07864764B1

公开(公告)日：2011-01-04

申请号：US12211371

申请日：2008-09-16

申请人： Qingming Ma ,  Bryan Burns ,  Xianzhi Li ,  Krishna Narayanaswamy

发明人： Qingming Ma ,  Bryan Burns ,  Xianzhi Li ,  Krishna Narayanaswamy

IPC分类号： H04L12/56 ,  H04L12/28 ,  H04L12/54

CPC分类号： H04L67/2847 ,  H04L12/413 ,  H04L69/22

摘要： In general, techniques are described for reducing response times to retrieve content in an intermediate network device. In particular, the intermediate network device receives a packet from a client device of a first network that requests content from a remote network device of a second network, inspects the packet to determine whether the requested content has been previously cached to either of a first and a second memory of the device, issues a request to load the requested content from the second memory to the first memory based on the determination and queues the packet within in the queue. After queuing the packet, the intermediate network device then processes the packet to assemble a response that includes the content from the memory.

摘要翻译： 通常，描述了用于减少在中间网络设备中检索内容的响应时间的技术。 特别地，中间网络设备从第一网络的客户端设备接收来自第二网络的远程网络设备的内容的分组，检查分组以确定所请求的内容是否先前已被缓存到第一和第 所述设备的第二存储器基于所述确定发出请求以将所请求的内容从所述第二存储器加载到所述第一存储器，并且对所述队列内的所述分组进行排队。 在对数据包进行排队之后，中间网络设备然后处理分组以组合包含来自存储器的内容的响应。

公开(公告)号：US08209291B1

公开(公告)日：2012-06-26

申请号：US12211167

申请日：2008-09-16

申请人： Qingming Ma ,  Krishna Narayanaswamy

发明人： Qingming Ma ,  Krishna Narayanaswamy

IPC分类号： G06F7/00

CPC分类号： G06F17/30442 ,  H04L67/2847

摘要： A data prefetching technique uses predefined prefetching criteria and prefetching models to identify and retrieve prefetched data. A prefetching model that defines data to be prefetched via a network may be stored. It may be determined whether prefetching initiation criteria have been satisfied. Data for prefetching may be identified based on the prefetching model when the prefetching initiation criteria have been satisfied. The identified data may be prefetched, via the network, based on the prefetching model.

摘要翻译： 数据预取技术使用预定义的预取准则和预取模型来识别和检索预取数据。 可以存储定义要通过网络预取的数据的预取模型。 可以确定是否已经满足预取启动标准。 当预取起始标准已被满足时，可以基于预取模型来识别用于预取的数据。 可以经由网络基于预取模型来预取识别的数据。

公开(公告)号：US08429130B2

公开(公告)日：2013-04-23

申请号：US13479645

申请日：2012-05-24

申请人： Qingming Ma ,  Krishna Narayanaswamy

发明人： Qingming Ma ,  Krishna Narayanaswamy

IPC分类号： G06F7/00

CPC分类号： G06F17/30442 ,  H04L67/2847

摘要： A data prefetching technique uses predefined prefetching criteria and prefetching models to identify and retrieve prefetched data. A prefetching model that defines data to be prefetched via a network may be stored. It may be determined whether prefetching initiation criteria have been satisfied. Data for prefetching may be identified based on the prefetching model when the prefetching initiation criteria have been satisfied. The identified data may be prefetched, via the network, based on the prefetching model.

摘要翻译： 数据预取技术使用预定义的预取准则和预取模型来识别和检索预取数据。 可以存储定义要通过网络预取的数据的预取模型。 可以确定是否已经满足预取启动标准。 当预取起始标准已被满足时，可以基于预取模型来识别用于预取的数据。 可以经由网络基于预取模型来预取识别的数据。

公开(公告)号：US20120233261A1

公开(公告)日：2012-09-13

申请号：US13479645

申请日：2012-05-24

申请人： Qingming MA ,  Krishna Narayanaswamy

发明人： Qingming MA ,  Krishna Narayanaswamy

IPC分类号： G06F15/16

CPC分类号： G06F17/30442 ,  H04L67/2847

摘要： A data prefetching technique uses predefined prefetching criteria and prefetching models to identify and retrieve prefetched data. A prefetching model that defines data to be prefetched via a network may be stored. It may be determined whether prefetching initiation criteria have been satisfied. Data for prefetching may be identified based on the prefetching model when the prefetching initiation criteria have been satisfied. The identified data may be prefetched, via the network, based on the prefetching model.

摘要翻译： 数据预取技术使用预定义的预取准则和预取模型来识别和检索预取数据。 可以存储定义要通过网络预取的数据的预取模型。 可以确定是否已经满足预取启动标准。 当预取起始标准已被满足时，可以基于预取模型来识别用于预取的数据。 可以经由网络基于预取模型来预取识别的数据。

公开(公告)号：US20110055921A1

公开(公告)日：2011-03-03

申请号：US12607107

申请日：2009-10-28

申请人： Krishna Narayanaswamy ,  Bryan Burns ,  Venkata Rama Raju Manthena

发明人： Krishna Narayanaswamy ,  Bryan Burns ,  Venkata Rama Raju Manthena

IPC分类号： H04L29/06 ,  G06F15/18

CPC分类号： H04L63/1458 ,  H04L63/1416

摘要： A network security device performs a three-stage analysis of traffic to identify malicious clients. In one example, a device includes an attack detection module to, during a first stage, monitor network connections to a protected network device, during a second stage, to monitor a plurality of types of transactions for the plurality of network sessions when a parameter for the connections exceeds a connection threshold, and during a third stage, to monitor communications associated with network addresses from which transactions of the at least one of type of transactions originate when a parameter associated with the at least one type of transactions exceeds a transaction-type threshold. The device executes a programmed action with respect to at least one of the network addresses when the transactions of the at least one of the plurality of types of transactions originating from the at least one network address exceeds a client-transaction threshold.

摘要翻译： 网络安全设备对流量执行三阶段分析，以识别恶意客户端。 在一个示例中，设备包括攻击检测模块，在第一阶段期间，在第二阶段期间，监视与受保护网络设备的网络连接，以监视多个网络会话的多种类型的事务，当用于 所述连接超过连接阈值，并且在第三阶段期间，当与所述至少一种类型的事务相关联的参数超过事务类型时，监视与所述至少一种类型的事务的事务起始的网络地址相关联的通信 阈。 当来自所述至少一个网络地址的所述多种类型的交易中的至少一种交易的交易超过客户端交易阈值时，所述设备相对于所述网络地址中的至少一个执行编程动作。

公开(公告)号：US20100281539A1

公开(公告)日：2010-11-04

申请号：US12432325

申请日：2009-04-29

申请人： Bryan Burns ,  Krishna Narayanaswamy

发明人： Bryan Burns ,  Krishna Narayanaswamy

IPC分类号： G06F21/00

CPC分类号： H04L63/1441 ,  H04L63/14 ,  H04L63/1416 ,  H04L2463/144

摘要： This disclosure describes techniques for determining whether a network session originates from an automated software agent. In one example, a network device, such as a router, includes a network interface to receive packets of a network session, a bot detection module to calculate a plurality of scores for network session data based on a plurality of metrics, wherein each of the metrics corresponds to a characteristic of a network session originated by an automated software agent, to produce an aggregate score from an aggregate of the plurality of scores, and to determine that the network session is originated by an automated software agent when the aggregate score exceeds a threshold, and an attack detection module to perform a programmed response when the network session is determined to be originated by an automated software agent. Each score represents a likelihood that the network session is originated by an automated software agent.

摘要翻译： 本公开描述了用于确定网络会话是否源于自动化软件代理的技术。 在一个示例中，诸如路由器的网络设备包括用于接收网络会话的分组的网络接口，基于多个度量来计算网络会话数据的多个分数的机器人检测模块，其中， 度量对应于由自动化软件代理发起的网络会话的特征，以从多个分数的聚合中产生聚合分数，并且当聚合分数超过一个分数时，确定网络会话由自动软件代理发起 阈值，以及当网络会话被确定为由自动化软件代理发起时执行编程响应的攻击检测模块。 每个分数表示网络会话由自动化软件代理发起的可能性。

公开(公告)号：US08914878B2

公开(公告)日：2014-12-16

申请号：US12432325

申请日：2009-04-29

申请人： Bryan Burns ,  Krishna Narayanaswamy

发明人： Bryan Burns ,  Krishna Narayanaswamy

IPC分类号： H04L29/06 ,  G06F21/00

CPC分类号： H04L63/1441 ,  H04L63/14 ,  H04L63/1416 ,  H04L2463/144

摘要： This disclosure describes techniques for determining whether a network session originates from an automated software agent. In one example, a network device, such as a router, includes a network interface to receive packets of a network session, a bot detection module to calculate a plurality of scores for network session data based on a plurality of metrics, wherein each of the metrics corresponds to a characteristic of a network session originated by an automated software agent, to produce an aggregate score from an aggregate of the plurality of scores, and to determine that the network session is originated by an automated software agent when the aggregate score exceeds a threshold, and an attack detection module to perform a programmed response when the network session is determined to be originated by an automated software agent. Each score represents a likelihood that the network session is originated by an automated software agent.

摘要翻译： 本公开描述了用于确定网络会话是否源于自动化软件代理的技术。 在一个示例中，诸如路由器的网络设备包括用于接收网络会话的分组的网络接口，基于多个度量来计算网络会话数据的多个分数的机器人检测模块，其中， 度量对应于由自动化软件代理发起的网络会话的特征，以从多个分数的聚合中产生聚合分数，并且当聚合分数超过一个分数时，确定网络会话由自动软件代理发起 阈值，以及当网络会话被确定为由自动化软件代理发起时执行编程响应的攻击检测模块。 每个分数表示网络会话由自动化软件代理发起的可能性。