Patent ID: 9432389
Filing Date: 2016-08-30
CPC Classification: H04L

Claim Text:
1. An apparatus for detecting one or more exploits, comprising: one or more hardware ports that provide connectivity between the apparatus and a transmission medium; network-traffic static analysis logic communicatively coupled to the one or more hardware ports, the network-traffic static analysis logic to conduct an analysis of a multi-flow object based on information from a plurality of related flows received via the one or more hardware ports by analyzing characteristics of the multi-flow object and determining if the characteristics of the multi-flow object are indicative of an exploit of the one of more exploits, wherein the analysis of the multi-flow object represents a static analysis of characteristics associated with the plurality of related flows and each flow of the plurality of related flows comprises one or more related messages communicated during a single communication session between a source network device and a destination network device; and a classification engine to receive results of the analysis of the multi-flow object and, based on the results of the analysis of the multi-flow object, determine whether the multi-flow object is the exploit.