Patent ID: 11902126
Assignee: FORESCOUT TECHNOLOGIES, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 0:
1. A method, comprising:
parsing data traffic to extract at least one protocol field of a protocol message of the data traffic to generate an extracted protocol field;
determining whether one or more models of a set of models corresponds to the extracted protocol field;
in response to determining that a selected model of the set of models corresponds to the extracted protocol field:
associating the extracted protocol field with the selected model of a set of models for the extracted protocol field;
assessing whether contents of the extracted protocol field are in a safe region of values for the at least one protocol field as defined by the selected model; and
generating an intrusion detection signal based on whether the contents of the extracted protocol field is outside the safe region of values; and

in response to determining that the extracted protocol field does not correspond to any of the models of the set of models:
generating the intrusion detection signal.