Patent ID: 7568227
Filing Date: 2009-07-28
Classification: H04L

Abstract:
1. A method for analyzing a network protocol stream for a security-related event, comprising: identifying at least two valid states associated with a network protocol in which a first host system communicating with a second host system using the network protocol may be placed; defining at least one valid transition between a first state of the at least two valid states and a second state of the at least two valid states; expressing the at least one valid transition in the form of a first regular expression; defining an invalid state associated with the network protocol; expressing a plurality of invalid transitions from the first state to the invalid state as a plurality of regular expressions, the plurality of invalid transitions being direct transitions from the first state to the invalid state; determining that a connection under the network protocol is in the first state; a computer receiving a packet associated with the connection; and applying to the received packet associated with the connection: the first regular expression to determine whether the packet is associated with the at least one valid transition, and the plurality of regular expressions to determine whether the packet is associated with one of a plurality of invalid transitions; and in the event it is determined by applying the plurality of regular expressions to the packet that the packet is associated with a particular one of the plurality of invalid transitions, taking a corresponding responsive action associated specifically with the particular one of the plurality of invalid transitions.