Patent ID: 11902126
Assignee: FORESCOUT TECHNOLOGIES, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 10:
11. A non-transitory computer readable medium having instructions stored thereon which, when executed by a processing device, causes the processing device to:
parse data traffic to extract at least one protocol field of a protocol message of the data traffic to generate an extracted protocol field;
determine whether one or more models of a set of models corresponds to the extracted protocol field;
in response to determining that a selected model of the set of models corresponds to the extracted protocol field:
associate the extracted protocol field with a selected model of a set of models for the extracted protocol field;
assess, by the processing device, whether contents of the extracted protocol field are in a safe region of values for the at least one protocol field as defined by the selected model; and
generate an intrusion detection signal based on whether the contents of the extracted protocol field is outside the safe region of values; and

in response to determining that the extracted protocol field does not correspond to any of the models of the set of models:
generate the intrusion detection signal.