公开(公告)号：US08261352B2

公开(公告)日：2012-09-04

申请号：US12468454

申请日：2009-05-19

申请人： Qingming Ma ,  Bryan Burns ,  Sheng Li ,  Na Liu ,  Xuejun Wu ,  Shan Yu ,  Li Zheng

发明人： Qingming Ma ,  Bryan Burns ,  Sheng Li ,  Na Liu ,  Xuejun Wu ,  Shan Yu ,  Li Zheng

IPC分类号： G06F21/06

CPC分类号： H04L63/1416

摘要： A method includes receiving a data unit, determining whether a current state, associated with a deterministic finite automata (DFA) that includes a portion of states in a bitmap and a remaining portion of states in a DFA table, is a bitmap state or not, and determining whether a value corresponding to the data unit is greater than a threshold value, when it is determined that the current state is not a bitmap state. The method further includes determining whether the current state is insensitive, when it is determined that the value corresponding to the data unit is greater than the threshold value, where insensitive means that each next state is a same state for the current state, and selecting a default state, as a next state for the current, when it is determined that the current state is insensitive.

摘要翻译： 一种方法包括接收数据单元，确定与包括位图中的状态的一部分和DFA表中的剩余部分状态的确定性有限自动机（DFA）相关联的当前状态是否为位图状态， 以及当确定当前状态不是位图状态时，确定对应于所述数据单元的值是否大于阈值。 该方法还包括当确定对应于数据单元的值大于阈值时确定当前状态是否不敏感，其中不确定意味着每个下一状态对于当前状态是相同的状态，并且选择 默认状态，作为当前的下一状态，当确定当前状态不敏感时。

公开(公告)号：US20100229238A1

公开(公告)日：2010-09-09

申请号：US12468454

申请日：2009-05-19

申请人： Qingming Ma ,  Bryan Burns ,  Sheng Li ,  Na Liu ,  Xuejun Wu ,  Shan Yu ,  Li Zheng

发明人： Qingming Ma ,  Bryan Burns ,  Sheng Li ,  Na Liu ,  Xuejun Wu ,  Shan Yu ,  Li Zheng

IPC分类号： G06F21/06

CPC分类号： H04L63/1416

摘要： A method includes receiving a data unit, determining whether a current state, associated with a deterministic finite automata (DFA) that includes a portion of states in a bitmap and a remaining portion of states in a DFA table, is a bitmap state or not, and determining whether a value corresponding to the data unit is greater than a threshold value, when it is determined that the current state is not a bitmap state. The method further includes determining whether the current state is insensitive, when it is determined that the value corresponding to the data unit is greater than the threshold value, where insensitive means that each next state is a same state for the current state, and selecting a default state, as a next state for the current, when it is determined that the current state is insensitive.

摘要翻译： 一种方法包括接收数据单元，确定与包括位图中的状态的一部分和DFA表中的剩余部分状态的确定性有限自动机（DFA）相关联的当前状态是否为位图状态， 以及当确定当前状态不是位图状态时，确定对应于所述数据单元的值是否大于阈值。 该方法还包括当确定对应于数据单元的值大于阈值时确定当前状态是否不敏感，其中不确定意味着每个下一状态对于当前状态是相同的状态，并且选择 默认状态，作为当前的下一状态，当确定当前状态不敏感时。

公开(公告)号：US09083740B1

公开(公告)日：2015-07-14

申请号：US12568319

申请日：2009-09-28

申请人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Li Zheng

发明人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Li Zheng

IPC分类号： H04L29/06 ,  G06F17/30

CPC分类号： H04L63/145 ,  G06F17/30985 ,  H04L63/0227 ,  H04L63/1408

摘要： In general, techniques are described for network traffic pattern matching using adaptive deterministic finite automata (DFA). A network device may implement the techniques to promote pattern matching. The network device comprises a control unit that stores first and second data defining first and second portions of a DFA, respectively. The first data defines first states of the DFA in an uncompressed format. The second data defines second states of the DFA in a compressed format. The network device also includes an interface that receives network packets. The control unit processes the network packets to traverse the first and second states. The control unit then compares a number of times the first and second states have been traversed. Based on the comparison, the control unit dynamically reallocates the first states of the DFA in the uncompressed format and the second states of the DFA in the compressed format.

摘要翻译： 一般来说，描述了使用自适应确定性有限自动机（DFA）进行网络流量模式匹配的技术。 网络设备可以实现促进模式匹配的技术。 网络设备包括分别存储定义DFA的第一和第二部分的第一和第二数据的控制单元。 第一个数据以未压缩格式定义了DFA的第一个状态。 第二个数据以压缩格式定义了DFA的第二个状态。 网络设备还包括接收网络分组的接口。 控制单元处理网络分组以遍历第一和第二状态。 然后，控制单元比较遍历第一和第二状态的次数。 基于比较，控制单元以未压缩格式动态地重新分配DFA的第一状态，并以压缩格式动态重新分配DFA的第二状态。

公开(公告)号：US07904961B2

公开(公告)日：2011-03-08

申请号：US11738059

申请日：2007-04-20

申请人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Vipin Rawat ,  Michael Chuong Shieh

发明人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Vipin Rawat ,  Michael Chuong Shieh

IPC分类号： G06F11/00

CPC分类号： H04L63/1416 ,  G06F21/552 ,  G06F21/74 ,  G06F21/76 ,  G06F2221/2105 ,  H04L63/0227

摘要： This disclosure describes techniques for determining whether network traffic contains one or more computer security threats. In order to determine whether a symbol stream conforms to the symbol pattern, a security device stores a full deterministic finite automaton (fDFA) that accepts streams of symbols that conform to the symbol pattern. The security device also creates a partial deterministic finite automaton (pDFA) that includes nodes that correspond to the nodes in the fDFA that have the highest visitation levels. The security device processes each symbol in the symbol stream using the pDFA until a symbol causes the pDFA to transition to a failure node or to an accepting node. If the symbol causes the pDFA to transition to the failure node, the security device processes the symbol and subsequent symbols in the symbol stream using the fDFA.

摘要翻译： 本公开描述了用于确定网络流量是否包含一个或多个计算机安全威胁的技术。 为了确定符号流是否符合符号模式，安全设备存储接受符合符号模式的符号流的完全确定性有限自动机（fDFA）。 安全设备还创建一个部分确定性有限自动机（pDFA），其中包含与fDFA中具有最高访问级别的节点相对应的节点。 安全设备使用pDFA处理符号流中的每个符号，直到符号导致pDFA转换到故障节点或接受节点。 如果符号导致pDFA转换到故障节点，则安全设备使用fDFA处理符号流中的符号和后续符号。

公开(公告)号：US20080263665A1

公开(公告)日：2008-10-23

申请号：US11738059

申请日：2007-04-20

申请人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Vipin Rawat ,  Michael Chuong Shieh

发明人： Qingming Ma ,  Bryan Burns ,  Krishna Narayanaswamy ,  Vipin Rawat ,  Michael Chuong Shieh

IPC分类号： G06F11/00

CPC分类号： H04L63/1416 ,  G06F21/552 ,  G06F21/74 ,  G06F21/76 ,  G06F2221/2105 ,  H04L63/0227

摘要： This disclosure describes techniques for determining whether network traffic contains one or more computer security threats. In order to determine whether a symbol stream conforms to the symbol pattern, a security device stores a full deterministic finite automaton (fDFA) that accepts streams of symbols that conform to the symbol pattern. The security device also creates a partial deterministic finite automaton (pDFA) that includes nodes that correspond to the nodes in the fDFA that have the highest visitation levels. The security device processes each symbol in the symbol stream using the pDFA until a symbol causes the pDFA to transition to a failure node or to an accepting node. If the symbol causes the pDFA to transition to the failure node, the security device processes the symbol and subsequent symbols in the symbol stream using the fDFA.

摘要翻译： 本公开描述了用于确定网络流量是否包含一个或多个计算机安全威胁的技术。 为了确定符号流是否符合符号模式，安全设备存储接受符合符号模式的符号流的完全确定性有限自动机（fDFA）。 安全设备还创建一个部分确定性有限自动机（pDFA），其中包含与fDFA中具有最高访问级别的节点相对应的节点。 安全设备使用pDFA处理符号流中的每个符号，直到符号导致pDFA转换到故障节点或接受节点。 如果符号导致pDFA转换到故障节点，则安全设备使用fDFA处理符号流中的符号和后续符号。

公开(公告)号：US07864764B1

公开(公告)日：2011-01-04

申请号：US12211371

申请日：2008-09-16

申请人： Qingming Ma ,  Bryan Burns ,  Xianzhi Li ,  Krishna Narayanaswamy

发明人： Qingming Ma ,  Bryan Burns ,  Xianzhi Li ,  Krishna Narayanaswamy

IPC分类号： H04L12/56 ,  H04L12/28 ,  H04L12/54

CPC分类号： H04L67/2847 ,  H04L12/413 ,  H04L69/22

摘要： In general, techniques are described for reducing response times to retrieve content in an intermediate network device. In particular, the intermediate network device receives a packet from a client device of a first network that requests content from a remote network device of a second network, inspects the packet to determine whether the requested content has been previously cached to either of a first and a second memory of the device, issues a request to load the requested content from the second memory to the first memory based on the determination and queues the packet within in the queue. After queuing the packet, the intermediate network device then processes the packet to assemble a response that includes the content from the memory.

摘要翻译： 通常，描述了用于减少在中间网络设备中检索内容的响应时间的技术。 特别地，中间网络设备从第一网络的客户端设备接收来自第二网络的远程网络设备的内容的分组，检查分组以确定所请求的内容是否先前已被缓存到第一和第 所述设备的第二存储器基于所述确定发出请求以将所请求的内容从所述第二存储器加载到所述第一存储器，并且对所述队列内的所述分组进行排队。 在对数据包进行排队之后，中间网络设备然后处理分组以组合包含来自存储器的内容的响应。

公开(公告)号：US20100192225A1

公开(公告)日：2010-07-29

申请号：US12361364

申请日：2009-01-28

申请人： Qingming Ma ,  Bryan Burns ,  Ricardo Oliveira

发明人： Qingming Ma ,  Bryan Burns ,  Ricardo Oliveira

IPC分类号： G06F21/00 ,  G06N5/02 ,  G06F15/18 ,  G06F15/16

CPC分类号： H04L63/0227 ,  G06F16/90344 ,  G06F21/552 ,  H04L63/1416

摘要： In general, techniques are described for efficiently implementing application identification within network devices. In particular, a network device includes a control unit that stores data defining a group Deterministic Finite Automata (DFA) and an individual DFA. The group DFA is formed by merging non-explosive DFAs generated from corresponding non-explosive regular expressions (regexs) and fingerprint DFAs (f-DFAs) generated from signature fingerprints extracted from explosive regexs. The non-explosive regexs comprise regexs determined not to cause state explosion during generation of the group DFA, the signature fingerprints comprise segments of explosive regexs that uniquely identifies the explosive regexs, and the explosive regexs comprise regexs determined to cause state explosion during generation of the group DFA. The network device includes an interface that receives a packet and the control unit traverses first the group DFA and then, in some instances, the individual DFAs to more efficiently identify network applications to which packets correspond.

摘要翻译： 通常，描述了用于在网络设备内有效实现应用识别的技术。 特别地，网络设备包括控制单元，其存储定义组确定性有限自动机（DFA）和单个DFA的数据。 组DFA是通过合并从相应的非爆炸正则表达式（正则表达式）生成的非爆炸性DFA和由从爆炸正则表达式提取的签名指纹生成的指纹DFA（f-DFA）而形成的。 非爆炸式正则表达式包括在组DFA生成期间确定不会导致状态爆炸的正则表达式，签名指纹包含唯一识别爆炸正则表达式的爆炸正则表达式的部分，并且爆炸正则表达式包括被确定为在生成期间导致状态爆炸的正则表达式 组DFA。 网络设备包括接收分组的接口，并且控制单元首先遍历组DFA，然后在某些情况下遍历各个DFA以更有效地识别分组对应的网络应用。

公开(公告)号：US08341724B1

公开(公告)日：2012-12-25

申请号：US12339948

申请日：2008-12-19

申请人： Bryan Burns ,  Vladimir Sukhanov

发明人： Bryan Burns ,  Vladimir Sukhanov

IPC分类号： H04L29/06

CPC分类号： H04L63/0428 ,  H04L63/1416 ,  H04L63/145 ,  H04L67/14 ,  H04L69/22 ,  H04L2463/144

摘要： Techniques are described for blocking unidentified encrypted communication sessions. In one embodiment, a device includes an interface to receive a packet, an application identification module to attempt to identify an application associated with the packet, an encryption detection module to determine whether the packet is encrypted when the application identification module is unable to identify an application associated with the packet, and an attack detection module to determine whether the packet is associated with a network attack, to forward the packet when the packet is not associated with a network attack, and to take a response when the packet is associated with a network attack, wherein the encryption detection module sends a message to the attack detection module that indicates whether the packet is encrypted, wherein when the message indicates that packet is encrypted, the attack detection module determines that the packet is associated with a network attack.

摘要翻译： 描述了阻止未识别的加密通信会话的技术。 在一个实施例中，一种设备包括用于接收分组的接口，用于尝试识别与所述分组相关联的应用的应用识别模块，加密检测模块，用于当所述应用识别模块不能识别所述分组时确定所述分组是否被加密 与分组关联的应用，以及攻击检测模块，用于确定分组是否与网络攻击相关联，以在分组不与网络攻击相关联时转发分组，以及当分组与网络攻击相关联时采取响应 网络攻击，其中所述加密检测模块向所述攻击检测模块发送指示所述分组是否被加密的消息，其中当所述消息指示所述分组被加密时，所述攻击检测模块确定所述分组与网络攻击相关联。

公开(公告)号：US08291495B1

公开(公告)日：2012-10-16

申请号：US11835923

申请日：2007-08-08

申请人： Bryan Burns ,  Siying Yang ,  Julien Sobrier

发明人： Bryan Burns ,  Siying Yang ,  Julien Sobrier

IPC分类号： G06F11/00

CPC分类号： H04L63/0254 ,  H04L63/1441 ,  H04L63/168

摘要： An intrusion detection system (“IDS”) device is described that includes a flow analysis module to receive a first packet flow from a client and to receive a second packet flow from a server. The IDS includes a forwarding component to send the first packet flow to the server and the second packet flow to the client and a stateful inspection engine to apply one or more sets of patterns to the first packet flow to determine whether the first packet flow represents a network attack. The IDS also includes an application identification module to perform an initial identification of a type of software application and communication protocol associated with the first packet flow and to reevaluate the identification of the type of software application and protocol according to the second packet flow. The IDS may help eliminate false positive and false negative attack identifications.

摘要翻译： 描述了入侵检测系统（IDS）设备，其包括用于从客户端接收第一分组流并从服务器接收第二分组流的流分析模块。 IDS包括将第一分组流发送到服务器的转发组件和到客户端的第二分组流以及状态检查引擎，以将一组或多组模式应用于第一分组流，以确定第一分组流是否代表 网络攻击 IDS还包括应用识别模块，用于执行与第一分组流相关联的软件应用和通信协议的类型的初始识别，并且根据第二分组流来重新评估软件应用和协议的类型的标识。 IDS可能有助于消除假阳性和假阴性攻击识别。

公开(公告)号：US08914878B2

公开(公告)日：2014-12-16

申请号：US12432325

申请日：2009-04-29

申请人： Bryan Burns ,  Krishna Narayanaswamy

发明人： Bryan Burns ,  Krishna Narayanaswamy

IPC分类号： H04L29/06 ,  G06F21/00

CPC分类号： H04L63/1441 ,  H04L63/14 ,  H04L63/1416 ,  H04L2463/144

摘要： This disclosure describes techniques for determining whether a network session originates from an automated software agent. In one example, a network device, such as a router, includes a network interface to receive packets of a network session, a bot detection module to calculate a plurality of scores for network session data based on a plurality of metrics, wherein each of the metrics corresponds to a characteristic of a network session originated by an automated software agent, to produce an aggregate score from an aggregate of the plurality of scores, and to determine that the network session is originated by an automated software agent when the aggregate score exceeds a threshold, and an attack detection module to perform a programmed response when the network session is determined to be originated by an automated software agent. Each score represents a likelihood that the network session is originated by an automated software agent.

摘要翻译： 本公开描述了用于确定网络会话是否源于自动化软件代理的技术。 在一个示例中，诸如路由器的网络设备包括用于接收网络会话的分组的网络接口，基于多个度量来计算网络会话数据的多个分数的机器人检测模块，其中， 度量对应于由自动化软件代理发起的网络会话的特征，以从多个分数的聚合中产生聚合分数，并且当聚合分数超过一个分数时，确定网络会话由自动软件代理发起 阈值，以及当网络会话被确定为由自动化软件代理发起时执行编程响应的攻击检测模块。 每个分数表示网络会话由自动化软件代理发起的可能性。