Patent ID: 9038161
Filing Date: 2015-05-19
Classification: G06F,H04L

Abstract:
1. A system for identifying a network traffic pattern indicative of a presence of an exploit in a network traffic, comprising: a processor; and computer readable instructions stored in a memory for execution by the processor, causing the processor to search for the network traffic pattern in a portion of the network traffic captured in the memory, the computer readable instructions further causing the processor to: (a) search for a first instruction pointing to a first address in the memory, the first instruction being a branch instruction transferring control to the first address in the memory; (b) provided the first instruction is found, search for a second instruction within a first predetermined interval in the memory starting from the first address onward, the second instruction being a subroutine call instruction pointing to a second address in the memory; (c) provided the second instruction is found, search for a third instruction at a third address in the memory, which is located at a second predetermined interval from the second address onward; (d) provided the third instruction is a fetch instruction, indicate the presence of the exploit; and (e) provided the third instruction is a branch instruction, transfer control to a fourth address in the memory, and provided a fetch instruction is located at the fourth address, indicate the presence of the exploit.