Patent ID: 8332941
Filing Date: 2012-12-11
Classification: G06F,H04L

Abstract:
1. A method for identifying a network traffic pattern indicative of a presence of an exploit in a network traffic, comprising: (a) capturing a portion of the network traffic; (b) searching the captured portion of the network traffic for the network traffic pattern, comprising: (b1) searching for a first instruction pointing to a first address in a memory, the first instruction being a branch instruction transferring control to the first address in the memory; (b2) provided the first instruction is found, searching for a second instruction within a first predetermined interval in the memory starting from the first address onward, the second instruction being a subroutine call instruction pointing to a second address in the memory; (b3) provided the second instruction is found, searching for a third instruction at a third address in the memory, which is located at a second predetermined interval from the second address onward; (b4) provided the third instruction is a fetch instruction, indicating the presence of the exploit; and (b5) provided the third instruction is a branch instruction, transferring control to a fourth address in the memory, and provided a fetch instruction is located at the fourth address, indicating the presence of the exploit.