Patent ID: 7948988
Filing Date: 2011-05-24
Classification: H04L

Abstract:
1. A method for analyzing fragment trains in a communication network, a fragment train including a plurality of fragments in the same fragment train and associated with a target system, comprising: determining, in an intrusion detection/prevention system, which kind of host is associated with the target system identified in a header of the fragments in the fragment train; reassembling, in the intrusion detection/prevention system, data in the fragments in the fragment train in an order indicated by a fragment reassembly policy selected from plural different fragment reassembly policies corresponding to different kinds of hosts based on the determined kind of host for the target system identified in the fragments in the fragment train, the fragment reassembly policy indicating an order specific to the fragment offset field and the more fragments flag in the fragments, when the fragment includes the more fragments flag indication, the order of the data indicated by the fragment reassembly policy is different from the order of the data when in fragments which do not include the more fragments flag indication, the data in fragments which include the more fragments flag indication and a same fragment offset further being reassembled in a different order in the different fragment reassembly policies.