Just in time memory analysis for malware detection

    公开(公告)号:US10902122B2

    公开(公告)日:2021-01-26

    申请号:US15890192

    申请日:2018-02-06

    申请人: SonicWALL Inc.

    IPC分类号: G06F21/55 G06F21/56

    摘要: Methods and apparatus consistent with the present disclosure may use instrumentation code that remains transparent to an application program that the instrumentation code has been injected into. In certain instances, data sets that include executable code may be received via packetized communications or be received via other means, such as, receiving a file from a data store. The present technique allows one or more processors executing instrumentation code to monitor actions performed by the program code included in a received data set. Malware can be detected using exception handling to track memory allocations of the program code included in the received data set.

    Packet processing on a multi-core processor
    2.
    发明授权
    Packet processing on a multi-core processor 有权
    在多核处理器上进行数据包处理

    公开(公告)号:US09098330B2

    公开(公告)日:2015-08-04

    申请号:US14079308

    申请日:2013-11-13

    申请人: SonicWALL, Inc.

    摘要: A method for packet processing on a multi-core processor. According to one embodiment of the invention, a first set of one or more processing cores are configured to include the capability to process packets belonging to a first set of one or more packet types, and a second set of one or more processing cores are configured to include the capability to process packets belonging to a second set of one or more packet types, where the second set of packet types is a subset of the first set of packet types. Packets belonging to the first set of packet types are processed at a processing core of either the first or second set of processing cores. Packets belonging to the second set of packet types are processed at a processing core of the first set of processing cores.

    摘要翻译: 一种在多核处理器上进行数据包处理的方法。 根据本发明的一个实施例,第一组一个或多个处理核心被配置为包括处理属于一个或多个分组类型的第一组的分组的能力,并且配置一个或多个处理核心的第二组 以包括处理属于一个或多个分组类型的第二组的分组的能力,其中第二组分组类型是第一组分组类型的子集。 属于第一组分组类型的分组在第一或第二组处理核心的处理核心处被处理。 属于第二组分组类型的分组在第一组处理核心的处理核心处被处理。

    REASSEMBLY-FREE DEEP PACKET INSPECTION ON MULTI-CORE HARDWARE
    4.
    发明申请
    REASSEMBLY-FREE DEEP PACKET INSPECTION ON MULTI-CORE HARDWARE 审中-公开
    多核心硬件免检深度分组检测

    公开(公告)号:US20140359764A1

    公开(公告)日:2014-12-04

    申请号:US14456884

    申请日:2014-08-11

    申请人: SonicWALL, Inc.

    IPC分类号: H04L29/06

    CPC分类号: H04L63/1408

    摘要: Some embodiments of reassembly-free deep packet inspection (DPD on multicore hardware have been presented. In one embodiment, a set of packets of one or more files is received at a networked device from one or more connections. Each packet is scanned using one of a set of processing cores in the networked device without buffering the one or more files in the networked device. Furthermore, the set of processing cores may scan the packets substantially concurrently.

    摘要翻译: 在一个实施例中,一个或多个文件的一组分组在一个或多个连接的网络设备处被接收,每个分组使用以下之一进行扫描: 网络设备中的一组处理核心,而不会缓存联网设备中的一个或多个文件。此外,该组处理核心可以基本同时扫描数据包。

    JUST IN TIME MEMORY ANALYSIS FOR MALWARE DETECTION

    公开(公告)号:US20190236275A1

    公开(公告)日:2019-08-01

    申请号:US15890192

    申请日:2018-02-06

    申请人: SonicWALL Inc.

    IPC分类号: G06F21/56

    CPC分类号: G06F21/566 G06F2221/034

    摘要: Methods and apparatus consistent with the present disclosure may use instrumentation code that remains transparent to an application program that the instrumentation code has been injected into. In certain instances, data sets that include executable code may be received via packetized communications or be received via other means, such as, receiving a file from a data store. The present technique allows one or more processors executing instrumentation code to monitor actions performed by the program code included in a received data set. Malware can be detected using exception handling to track memory allocations of the program code included in the received data set.

    PACKET PROCESSING ON A MULTI-CORE PROCESSOR
    6.
    发明申请
    PACKET PROCESSING ON A MULTI-CORE PROCESSOR 有权
    多核处理器上的分组处理

    公开(公告)号:US20140068622A1

    公开(公告)日:2014-03-06

    申请号:US14079308

    申请日:2013-11-13

    申请人: SonicWALL, Inc.

    IPC分类号: G06F9/48

    摘要: A method for packet processing on a multi-core processor. According to one embodiment of the invention, a first set of one or more processing cores are configured to include the capability to process packets belonging to a first set of one or more packet types, and a second set of one or more processing cores are configured to include the capability to process packets belonging to a second set of one or more packet types, where the second set of packet types is a subset of the first set of packet types. Packets belonging to the first set of packet types are processed at a processing core of either the first or second set of processing cores. Packets belonging to the second set of packet types are processed at a processing core of the first set of processing cores.

    摘要翻译: 一种在多核处理器上进行数据包处理的方法。 根据本发明的一个实施例,第一组一个或多个处理核心被配置为包括处理属于一个或多个分组类型的第一组的分组的能力,并且配置一个或多个处理核心的第二组 以包括处理属于一个或多个分组类型的第二组的分组的能力,其中第二组分组类型是第一组分组类型的子集。 属于第一组分组类型的分组在第一或第二组处理核心的处理核心处被处理。 属于第二组分组类型的分组在第一组处理核心的处理核心处被处理。