Source: http://www.google.com/patents/US7885190?dq=6,360,693
Timestamp: 2013-12-20 17:16:36
Document Index: 101622337

Matched Legal Cases: ['application No. 07', 'application No. 07015003', 'application No. 07014575', 'application No. 05773501', 'application No. 05773501', 'application No. 2007']

Patent US7885190 - Systems and methods for determining characteristics of a network based on ... - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inAdvanced Patent SearchPatentsA packet transmitted on a network is read and decoded. A network device and its operating system are identified by analyzing the decoded packet. If more than one operating system is identified from the decoded packet, the operating system is selecting by comparing confidence values assigned to the operating...http://www.google.com/patents/US7885190?utm_source=gb-gplus-sharePatent US7885190 - Systems and methods for determining characteristics of a network based on flow analysisAdvanced Patent SearchPublication numberUS7885190 B1Publication typeGrantApplication numberUS 10/843,374Publication dateFeb 8, 2011Filing dateMay 12, 2004Priority dateMay 12, 2003Also published asUS7496662, US7716742, US7730175, US7801980, US7949732, US8578002Publication number10843374, 843374, US 7885190 B1, US 7885190B1, US-B1-7885190, US7885190 B1, US7885190B1InventorsMartin Roesch, Ronald A. DempsterOriginal AssigneeSourcefire, Inc.Export CitationBiBTeX, EndNote, RefManPatent Citations (109), Non-Patent Citations (131), Referenced by (11), Classifications (8), Legal Events (1) External Links: USPTO, USPTO Assignment, EspacenetSystems and methods for determining characteristics of a network based on flow analysisUS 7885190 B1Abstract A packet transmitted on a network is read and decoded. A network device and its operating system are identified by analyzing the decoded packet. If more than one operating system is identified from the decoded packet, the operating system is selecting by comparing confidence values assigned to the operating systems identified. A service running on the network device is identified from the decoded packet or subsequent packets that are read, decoded and analyzed. The network topology of a network is determined by reading, decoding, and analyzing a plurality of packets. A flow between two network devices is determined by reading, decoding, and analyzing a plurality of packets. Vulnerabilities are assigned to operating systems and services identified by reading, decoding, and analyzing packets. Network configuration policy is enforced on operating systems and services identified by reading, decoding, and analyzing packets.
Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS4550436Jul 26, 1983Oct 29, 1985At&T Bell LaboratoriesParallel text matching methods and apparatusUS4570157Dec 6, 1983Feb 11, 1986Uro Denski Kogyo, K.K.Infrared intrusion alarm system capable of preventing false signalsUS4857912Jul 27, 1988Aug 15, 1989The United States Of America As Represented By The Secretary Of The NavyIntelligent security assessment systemUS4912748Sep 23, 1988Mar 27, 1990Matsushita Electric Works, Ltd.Infrared intrusion detector with a plurality of infrared ray detecting elementsUS4985863Jul 30, 1990Jan 15, 1991Hitachi, Ltd.Document storage and retrieval systemUS5193192Aug 23, 1990Mar 9, 1993Supercomputer Systems Limited PartnershipVectorized LR parsing of computer programsUS5222081Jun 28, 1991Jun 22, 1993Universal Data Systems, Inc.Method of performing an autobaud function using a state flow machineUS5404488Oct 1, 1993Apr 4, 1995Lotus Development CorporationRealtime data feed engine for updating an application with the most currently received data from multiple data feedsUS5430842May 29, 1992Jul 4, 1995Hewlett-Packard CompanyInsertion of network data checksums by a network adapterUS5459841Dec 28, 1993Oct 17, 1995At&T Corp.Finite state machine with minimized vector processingUS5497463Sep 25, 1992Mar 5, 1996Bull Hn Information Systems Inc.Ally mechanism for interconnecting non-distributed computing environment (DCE) and DCE systems to operate in a network systemUS5604910Oct 17, 1989Feb 18, 1997Hitachi, Ltd.Method of and vector processor for searching text for key words based on candidate character strings obtained from the text using parallel processingUS5666293Jul 3, 1995Sep 9, 1997Bell Atlantic Network Services, Inc.Downloading operating system software through a broadcast channelUS5796942Nov 21, 1996Aug 18, 1998Computer Associates International, Inc.Method and apparatus for automated network-wide surveillance and security breach interventionUS5870554Apr 1, 1996Feb 9, 1999Advanced Micro Devices, Inc.Server selection method where a client selects a server according to address, operating system and found frame for remote bootingUS5901307Jul 22, 1996May 4, 1999International Business Machines CorporationProcessor having a selectively configurable branch prediction unit that can access a branch prediction utilizing bits derived from a plurality of sourcesUS5917821 *Dec 21, 1994Jun 29, 1999Newbridge Networks CorporationLook-up engine for packet-based networkUS5919257Aug 8, 1997Jul 6, 1999Novell, Inc.Networked workstation intrusion detection systemUS5963942Dec 24, 1996Oct 5, 1999Fujitsu LimitedPattern search apparatus and methodUS5987473Dec 29, 1997Nov 16, 1999Beologic A/SInteractive configuration via networkUS5995963Mar 4, 1997Nov 30, 1999Fujitsu LimitedApparatus and method of multi-string matching based on sparse state transition listUS5999937Jun 6, 1997Dec 7, 1999Madison Information Technologies, Inc.System and method for converting data between data setsUS6002427Sep 15, 1997Dec 14, 1999Kipust; Alan J.Security system with proximity sensing for an electronic deviceUS6141686 *Jun 23, 1998Oct 31, 2000Deterministic Networks, Inc.Client-side application-classifier gathering network-traffic statistics and application and user names using extensible-service provider plugin for policy-based network controlUS6199181Sep 9, 1998Mar 6, 2001Perfecto Technologies Ltd.Method and system for maintaining restricted operating environments for application programs or operating systemsUS6219786Sep 9, 1998Apr 17, 2001Surfcontrol, Inc.Method and system for monitoring and controlling network accessUS6320848Apr 30, 1999Nov 20, 2001Hewlett-Packard CompanyMethods of altering dynamic decision treesUS6321338Nov 9, 1998Nov 20, 2001Sri InternationalNetwork surveillanceUS6324656Jun 30, 1998Nov 27, 2001Cisco Technology, Inc.System and method for rules-driven multi-phase network vulnerability assessmentUS6334121Mar 12, 1999Dec 25, 2001Virginia Commonwealth UniversityUsage pattern based user authenticatorUS6343362Jan 21, 1999Jan 29, 2002Networks Associates, Inc.System and method providing custom attack simulation language for testing networksUS6393474Dec 31, 1998May 21, 20023Com CorporationDynamic policy management apparatus and method using active network devicesUS6415321Dec 29, 1998Jul 2, 2002Cisco Technology, Inc.Domain mapping method and systemUS6477648Mar 23, 1997Nov 5, 2002Novell, Inc.Trusted workstation in a networked client/server computing systemUS6487666 *Jan 15, 1999Nov 26, 2002Cisco Technology, Inc.Intrusion detection signature analysis using regular expressions and logical operatorsUS6499107Dec 29, 1998Dec 24, 2002Cisco Technology, Inc.Method and system for adaptive network security using intelligent packet analysisUS6539381Apr 21, 1999Mar 25, 2003Novell, Inc.System and method for synchronizing database informationUS6587876Aug 24, 1999Jul 1, 2003Hewlett-Packard Development CompanyGrouping targets of management policiesUS6590885Jul 9, 1999Jul 8, 2003Malibu Networks, Inc.IP-flow characterization in a wireless point to multi-point (PTMP) transmission systemUS6678734Nov 13, 1999Jan 13, 2004Ssh Communications Security Ltd.Method for intercepting network packets in a computing deviceUS6678824Nov 2, 1999Jan 13, 2004Agere Systems Inc.Application usage time limiterUS6684332Jun 10, 1998Jan 27, 2004International Business Machines CorporationMethod and system for the exchange of digitally signed objects over an insecure networkUS6711127Jul 31, 1998Mar 23, 2004General Dynamics Government Systems CorporationSystem for intrusion detection and vulnerability analysis in a telecommunications signaling networkUS6754826Mar 31, 1999Jun 22, 2004International Business Machines CorporationData processing system and method including a network access connector for limiting access to the networkUS6766320Aug 24, 2000Jul 20, 2004Microsoft CorporationSearch engine with natural language-based robust parsing for user query and relevance feedback learningUS6772196Jul 27, 2000Aug 3, 2004Propel Software Corp.Electronic mail filtering system and methodsUS6789202Oct 15, 1999Sep 7, 2004Networks Associates Technology, Inc.Method and apparatus for providing a policy-driven intrusion detection systemUS6851061 *Aug 24, 2000Feb 1, 2005Networks Associates, Inc.System and method for intrusion detection data collection using a network protocol stack multiplexorUS6957348Jan 10, 2001Oct 18, 2005Ncircle Network Security, Inc.Interoperability of vulnerability and intrusion detection systemsUS6983323Aug 12, 2002Jan 3, 2006Tippingpoint Technologies, Inc.Multi-level packet screening with dynamically selected filtering criteriaUS6999998 *Oct 4, 2001Feb 14, 2006Hewlett-Packard Development Company, L.P.Shared memory coupling of network infrastructure devicesUS7032114Aug 30, 2000Apr 18, 2006Symantec CorporationSystem and method for using signatures to detect computer intrusionsUS7058821Jan 17, 2002Jun 6, 2006Ipolicy Networks, Inc.System and method for detection of intrusion attacks on packets transmitted on a networkUS7065657Aug 30, 2000Jun 20, 2006Symantec CorporationExtensible intrusion detection systemUS7073198Aug 25, 2000Jul 4, 2006Ncircle Network Security, Inc.Method and system for detecting a vulnerability in a networkUS7076803Jan 28, 2002Jul 11, 2006International Business Machines CorporationIntegrated intrusion detection servicesUS7096503Jun 29, 2001Aug 22, 2006Mcafee, Inc.Network-based risk-assessment tool for remotely detecting local computer vulnerabilitiesUS7113789Sep 24, 2001Sep 26, 2006Bellsouth Intellectual Property CorporationMethod and system for tracking facilities related informationUS7133916Jul 28, 2003Nov 7, 2006Etelemetry, Inc.Asset tracker for identifying user of current internet protocol addresses within an organization's communications networkUS7134141Jun 12, 2001Nov 7, 2006Hewlett-Packard Development Company, L.P.System and method for host and network based intrusion detection and responseUS7152105 *Jan 15, 2002Dec 19, 2006Mcafee, Inc.System and method for network vulnerability detection and reportingUS7181769Jun 6, 2003Feb 20, 2007Ncircle Network Security, Inc.Network security system having a device profiler communicatively coupled to a traffic monitorUS7257630 *Mar 10, 2003Aug 14, 2007Mcafee, Inc.System and method for network vulnerability detection and reportingUS7305708Mar 8, 2004Dec 4, 2007Sourcefire, Inc.Methods and systems for intrusion detectionUS7310688Aug 29, 2000Dec 18, 2007Ciena CorporationRelative addressing for network elementsUS7313695Mar 23, 2004Dec 25, 2007Sourcefire, Inc.Systems and methods for dynamic threat assessmentUS7315801Jan 14, 2000Jan 1, 2008Secure Computing CorporationNetwork security modeling system and methodUS7317693May 12, 2004Jan 8, 2008Sourcefire, Inc.Systems and methods for determining the network topology of a networkUS7350077Apr 17, 2003Mar 25, 2008Cisco Technology, Inc.802.11 using a compressed reassociation exchange to facilitate fast handoffUS7363656Nov 3, 2003Apr 22, 2008Mazu Networks, Inc.Event detection/anomaly correlation heuristicsUS7644275Apr 15, 2003Jan 5, 2010Microsoft CorporationPass-thru for client authenticationUS20010027485 *Mar 29, 2001Oct 4, 2001Tomohiko OgishiMethod for collecting statistical traffic dataUS20010034847Mar 27, 2001Oct 25, 2001Gaul,Jr. Stephen E.Internet/network security method and system for checking security of a client from a remote facilityUS20020035639Aug 16, 2001Mar 21, 2002Wei XuSystems and methods for a packet directorUS20020066034Sep 21, 2001May 30, 2002Schlossberg Barry J.Distributed network security deception systemUS20020083344Jun 27, 2001Jun 27, 2002Vairavan Kannan P.Integrated intelligent inter/intra networking deviceUS20020087716Dec 4, 2000Jul 4, 2002Shakeel MustafaSystem and method for transmitting customized multi priority services on a single or multiple links over data link layer framesUS20020112185Feb 26, 2001Aug 15, 2002Hodges Jeffrey D.Intrusion threat detectionUS20020123995Jan 11, 2002Sep 5, 2002Tetsuo ShibuyaPattern search method, pattern search apparatus and computer program therefor, and storage medium thereofUS20020165707Feb 26, 2001Nov 7, 2002Call Charles G.Methods and apparatus for storing and processing natural language text data as a sequence of fixed length integersUS20030014662Jun 13, 2002Jan 16, 2003Gupta Ramesh M.Protocol-parsing state machine and method of using sameUS20030046388Sep 4, 2002Mar 6, 2003Milliken Walter ClarkSystems and methods for network performance measurement using packet signature collectionUS20030065817 *Sep 28, 2001Apr 3, 2003Uri BenchetritExtended internet protocol network address translation systemUS20030083847Oct 31, 2001May 1, 2003Schertz Richard L.User interface for presenting data for an intrusion protection systemUS20030093517Oct 31, 2001May 15, 2003Tarquini Richard P.System and method for uniform resource locator filteringUS20030101353 *Oct 31, 2001May 29, 2003Tarquini Richard PaulMethod, computer-readable medium, and node for detecting exploits based on an inbound signature of the exploit and an outbound signature in response theretoUS20030140250Mar 7, 2002Jul 24, 2003Yoshihito TaninakaMethod and system of monitoring vulnerabilitiesUS20030195874Mar 7, 2003Oct 16, 2003Fujitsu LimitedSearch apparatus and method using order pattern including repeating patternUS20030212910Mar 28, 2003Nov 13, 2003Rowland Craig H.Method and system for reducing the false alarm rate of network intrusion detection systemsUS20030229726Mar 18, 2003Dec 11, 2003Daseke Michael J.Default device configuration system and method for thin devicesUS20040010684Jun 10, 1998Jan 15, 2004Ibm CorporationMethod and system for the exchange of digitally signed objects over an insecure networkUS20040015728Mar 10, 2003Jan 22, 2004Cole David M.System and method for network vulnerability detection and reportingUS20040034773Aug 19, 2002Feb 19, 2004Balabine Igor V.Establishing authenticated network connectionsUS20040064726Sep 30, 2002Apr 1, 2004Mario GirouardVulnerability management and tracking system (VMTS)US20040073800May 22, 2003Apr 15, 2004Paragi ShahAdaptive intrusion detection systemUS20040093582Oct 31, 2003May 13, 2004Segura Tim E.Method for allowing a computer to be used as an information kiosk while lockedUS20040098618Aug 14, 2003May 20, 2004Kim Hyun JooSystem and method for defending against distributed denial-of-service attack on active networkUS20040123153Apr 11, 2003Jun 24, 2004Michael WrightAdministration of protection of data accessible by a mobile deviceUS20040172234Oct 3, 2003Sep 2, 2004Dapp Michael C.Hardware accelerator personality compilerUS20040179477Mar 15, 2004Sep 16, 2004Lincoln Patrick DenisMethod and apparatus for processing network packetsUS20040193943Feb 12, 2004Sep 30, 2004Robert AngelinoMultiparameter network fault detection system using probabilistic and aggregation analysisUS20040210756Apr 15, 2003Oct 21, 2004Microsoft CorporationPass-thru for client authenticationUS20040218532Apr 29, 2003Nov 4, 2004Stanislav KhirmanMethod and system for transport protocol reconstruction and timer synchronization for non-intrusive capturing and analysis of packets on a high-speed distributed networkUS20040221176Apr 29, 2003Nov 4, 2004Cole Eric B.Methodology, system and computer readable medium for rating computer system vulnerabilitiesUS20040250032Jun 6, 2003Dec 9, 2004Minwen JiState machine and system for data redundancyUS20040268358Jun 30, 2003Dec 30, 2004Microsoft CorporationNetwork load balancing with host status informationUS20050005169Apr 9, 2004Jan 6, 2005Samir Gurunath KelekarSystem for real-time network-based vulnerability assessment of a host/device via real-time tracking, vulnerability assessment of services and a method thereofUS20050044422Aug 31, 2004Feb 24, 2005Craig CantrellActive network defense system and methodUS20050076066Oct 7, 2003Apr 7, 2005International Business Machines CorporationMethod, system, and program for retaining versions of files* Cited by examinerNon-Patent CitationsReference1"Snort(TM) Users Manual 2.6.0," The Snort Project (May 23, 2006), pp. 1-126.2"TaoSecurity-Dedicated to FreeBSD, network security monitoring, incident response, and network forensics," (Oct. 1, 2007), obtained from: http://taosecurity.blogspot.com/2005/02/shmoocon-concludes-shmoocon-finished.html.3"toupper()-convert lowercase character to uppercase," http://www.mkssoftware.com, printed on Sep. 20, 2008 from http://web.archive.org, archive date Jun. 30, 2006, 2 pp.4"Snort� Users Manual 2.6.0," The Snort Project (May 23, 2006), pp. 1-126.5"TaoSecurity�Dedicated to FreeBSD, network security monitoring, incident response, and network forensics," (Oct. 1, 2007), obtained from: http://taosecurity.blogspot.com/2005/02/shmoocon-concludes-shmoocon-finished.html.6"toupper()�convert lowercase character to uppercase," http://www.mkssoftware.com, printed on Sep. 20, 2008 from http://web.archive.org, archive date Jun. 30, 2006, 2 pp.7Advisory Action issued by the U.S. Patent Office on Dec. 2, 2009 in connection with related U.S. Appl. No. 10/843,398.8Advisory Action issued by the U.S. Patent Office on Feb. 24, 2010 in connection with related U.S. Appl. No. 11/272,035.9Advisory Action issued by the U.S. Patent Office on Sep. 29, 2009 in connection with related U.S. Appl. No. 10/843,459.10Aho et al., "Efficient String Matching: An Aid to Bibliographic Search," Communications from the ACM (Jun. 1975), vol. 18, No. 6, pp. 333-340.11B. Krishnamurthy, "Web Protocols and Practice," (May 1, 2001), pp. 518-520.12D. Joseph, et al., "A Policy-aware Switching Layer for Data Centers," SIGCOMM, Aug. 17-22, 2008, pp. 51-62.13D. Roelker, "HTTP IDS Evasions Revisited" (Aug. 1, 2003) [online] (retrieved on Nov. 9, 2006). Retrieved from the Internet .14D. Roelker, "HTTP IDS Evasions Revisited" (Aug. 1, 2003) [online] (retrieved on Nov. 9, 2006). Retrieved from the Internet <URL: http://docs.idsresearch.org/http�ids�evasions.pdf>.15European Office Action issued by the European Patent Office on Nov. 28, 2008 in connection with European patent application No. 07 015 003.2-2413, which corresponds to related U.S. Appl. No. 11/501,776.16European Search Report issued by the European Patent Office on Dec. 27, 2007 in connection with European patent application No. 07015003.2-2413, which corresponds to related U.S. Appl. No. 11/501,776.17European Search Report issued by the European Patent Office on Nov. 22, 2007 in connection with European patent application No. 07014575.0-1244, which corresponds to related U.S. Appl. No. 11/493,934.18European Search Report issued by the European Patent Office on Oct. 12, 2009 in connection with European patent application No. 05773501.1-2201, which corresponds to related U.S. Appl. Nos. 10/898,220, 11/785,609 and 12/010,900.19Final Office Action issued by the U.S. Patent Office on Aug. 19, 2008 in connection with related U.S. Appl. No. 10/843,373.20Final Office Action issued by the U.S. Patent Office on Aug. 20, 2008 in connection with related U.S. Appl. No. 10/843,353.21Final Office Action issued by the U.S. Patent Office on Aug. 6, 2008 in connection with related U.S. Appl. No. 10/843,375.22Final Office Action issued by the U.S. Patent Office on Dec. 8, 2009 in connection with related U.S. Appl. No. 11/272,034.23Final Office Action issued by the U.S. Patent Office on Dec. 9, 2009 in connection with related U.S. Appl. No. 11/272,035.24Final Office Action issued by the U.S. Patent Office on Jul. 17, 2008 in connection with related U.S. Appl. No. 10/843,459.25Final Office Action issued by the U.S. Patent Office on Jun. 26, 2008 in connection with related U.S. Appl. No. 10/898,220.26Final Office Action issued by the U.S. Patent Office on Jun. 4, 2008 in connection with related U.S. Appl. No. 10/843,398.27Final Office Action issued by the U.S. Patent Office on May 9, 2008 in connection with related U.S. Appl. No. 10/843,353.28Final Office Action issued by the U.S. Patent Office on Oct. 29, 2009 in connection with related U.S. Appl. No. 11/501,776.29Final Office Action issued by the U.S. Patent Office on Sep. 17, 2010 in connection with related U.S. Appl. No. 11/711,876.30Final Office Action issued by the U.S. Patent Office on Sep. 30, 2010 in connection with U.S. Appl. No. 11/493,934.31Final Office Action issued by the U.S. Patent Office on Sep. 8, 2010 in connection with related U.S. Appl. No. 10/843,459.32Full Band and Matrix Algorithms (Jun. 9, 2004), http://web.archive.org/web20040109154658/http://www.netlib.org/utk/Isi/pcwLSI/text/node150.html.33International Preliminary Report on Patentability and Written Opinion of the International Searching Authority mailed on Mar. 17, 2009 in connection with corresponding PCT application No. PCT/US06/43820, which corresponds to related U.S. Appl. No. 11/272,035.34International Preliminary Report on Patentability and Written Opinion of the International Searching Authority mailed on Mar. 3, 2009 in connection with PCT application No. PCT/US05/025584, which corresponds to related U.S. Appl. No. 10/898,220.35International Preliminary Report on Patentability mailed on Apr. 7, 2009 in connection with PCT application No. PCT/US07/021351, which corresponds to U.S. Appl. No. 11/905,980.36International Preliminary Report on Patentability mailed on May 22, 2008 in connection with PCT application No. PCT/US06/43800, which corresponds to U.S. Appl. No. 11/272,034.37International Preliminary Report on Patentability mailed on Nov. 12, 2009 in connection with PCT application No. PCT/US08/005466, which corresponds to U.S. Appl. No. 12/149,196.38International Preliminary Report on Patentability mailed on Sep. 11, 2009 in connection with PCT application No. PCT/US08/002454, which corresponds to U.S. Appl. No. 11/711,876.39International Search Report and Written Opinion of the International Searching Authority issued on Aug. 18, 2008 in connection with PCT application No. PCT/US08/05466, which corresponds to U.S. Appl. No. 12/149,196.40International Search Report and Written Opinion of the International Searching Authority issued on Dec. 5, 2007 in connection with PCT application No. PCT/US05/25583, which corresponds to U.S. Appl. No. 10/951,796.41International Search Report and Written Opinion of the International Searching Authority issued on Jul. 2, 2008 in connection with PCT application No. PCT/US08/02454, which corresponds to U.S. Appl. No. 11/711,876.42International Search Report and Written Opinion of the International Searching Authority issued on Jul. 7, 2008 in connection with PCT application No. PCT/US06/43820, which corresponds to U.S. Appl. No. 11/272,035.43International Search Report and Written Opinion of the International Searching Authority issued on Jun. 19, 2008 in connection with PCT application No. PCT/US05/25584, which corresponds to U.S. Appl. No. 10/898,220.44International Search Report and Written Opinion of the International Searching Authority issued on Jun. 30, 2008 in connection with PCT application No. PCT/US07/21351, which corresponds to U.S. Appl. No. 11/905,980.45International Search Report and Written Opinion of the International Searching Authority issued on Mar. 16, 2010 in connection with PCT application No. PCT/US09/59965, which corresponds to U.S. Appl. No. 12/575,612.46International Search Report and Written Opinion of the International Searching Authority issued on Oct. 9, 2007 in connection with PCT application No. PCT/US06/43800, which corresponds to U.S. Appl. No. 11/272,034.47International Search Report and Written Opinion of the International Searching Authority mailed on May 27, 2009 in connection with PCT application No. PCT/US09/02210, which corresponds to U.S. Appl. No. 12/230,338.48J. Howe, "An Environment for "Sniffing" DCE-RPC Traffic," CITI Technical Report 93-4, Jun. 21, 1993, 12 pages total.49J. Novak et al., "Target-Based TCP Stream Reassembly" (Aug. 3, 2007), Revision 1.0, pp. 1-23, obtained from: http://www.snort/org/docs/stream5-modelAUg032007.pdf.50J. Novak, "Target-Based Fragmentation Reassembly" (Apr. 2005), Revision 2.0, pp. 1-32.51Lyon, Gordon; Remote OS detection via TCP/IP Stack Fingerprinting, Jun. 30, 2002; pp. 1-12; obtained from: http://web.archive.org/web/20021017063625/www.insecure.org/nmap/nmap-fingerprinting-article.html.52M. Norton, "Optimizing Pattern Matching for Intrusion Detection" (Jul. 4, 2004) [online] (retrieved on Nov. 9, 2006). Retrieved from the Internet .53M. Norton, "Optimizing Pattern Matching for Intrusion Detection" (Jul. 4, 2004) [online] (retrieved on Nov. 9, 2006). Retrieved from the Internet <URL: http://docs.idsresearch.org/OptimizingPatternMatchingForIDS.pdf>.54N. Brownlee, et al., "Methodology for Passive Analysis of a University Internet Link," PAM2001 Passive and Active Measurement Workshop, Apr. 2001 (7 pp.).55N. Chase, "Active Server pp. 3.0 from Scratch" (Dec. 1999), Searching for products section, 13 pp.56Norton et al., "Multi-Patten Search Engine Aho-Corasick State Machine" (Mar. 17, 2004), Version 2.0, 36 pp.57Norton et al., "Sourcefire Optimizing Pattern Matching for Intrusion Detection" (Sep. 2004), 14 pp.58Notice of Allowance issued by the U.S. Patent Office on Aug. 18, 2008 in connection with related U.S. Appl. No. 11/272,033.59Notice of Allowance issued by the U.S. Patent Office on Dec. 8, 2009 in connection with related U.S. Appl. No. 11/501,776.60Notice of Allowance issued by the U.S. Patent Office on Feb. 5, 2010 in connection with related U.S. Appl. No. 11/272,034.61Notice of Allowance issued by the U.S. Patent Office on Jan. 21, 2009 in connection with related U.S. Appl. No. 10/898,220.62Notice of Allowance issued by the U.S. Patent Office on Jan. 7, 2010 in connection with related U.S. Appl. No. 10/843,353.63Notice of Allowance issued by the U.S. Patent Office on Jan. 8, 2010 in connection with related U.S. Appl. No. 10/843,373.64Notice of Allowance issued by the U.S. Patent Office on Jun. 11, 2009 in connection with related U.S. Appl. No. 10/843,373.65Notice of Allowance issued by the U.S. Patent Office on Mar. 5, 2010 in connection with related U.S. Appl. No. 11/785,609.66Notice of Allowance issued by the U.S. Patent Office on May 24, 2010 in connection with related U.S. Appl. No. 10/843,398.67Notice of Allowance issued by the U.S. Patent Office on Oct. 15, 2008 in connection with related U.S. Appl. No. 10/951,796.68Notice of Allowance issued by the U.S. Patent Office on Oct. 21, 2008 in connection with related U.S. Appl. No. 10/843,375.69Notice of Allowance issued by the U.S. Patent Office on Oct. 5, 2007 in connection with related U.S. Appl. No. 10/793,887.70Notice of Allowance issued by the U.S. Patent Office on Sep. 6, 2007 in connection with related U.S. Appl. No. 10/843,376.71Office Action issued by the European Patent Office on Jan. 15, 2010 in connection with European patent application No. 05773501.1-2201, which corresponds to related U.S. Appl. Nos. 10/898,220, 11/785,609 and 12/010,900.72Office Action issued by the U.S. Patent Office on Apr. 15, 2010 in connection with related U.S. Appl. No. 12/010,900.73Office Action issued by the U.S. Patent Office on Apr. 21, 2010 in connection with related U.S. Appl. No. 10/843,459.74Office Action issued by the U.S. Patent Office on Apr. 28, 2009 in connection with related U.S. Appl. No. 11/501,776.75Office Action issued by the U.S. Patent Office on Apr. 7, 2010 in connection with related U.S. Appl. No. 11/711,876.76Office Action issued by the U.S. Patent Office on Dec. 17, 2008 in connection with related U.S. Appl. No. 10/843,398.77Office Action issued by the U.S. Patent Office on Dec. 17, 2009 in connection with related U.S. Appl. No. 11/493,934.78Office Action issued by the U.S. Patent Office on Dec. 23, 2008 in connection with related U.S. Appl. No. 11/272,034.79Office Action issued by the U.S. Patent Office on Feb. 21, 2008 in connection with related U.S. Appl. No. 11/272,033.80Office Action issued by the U.S. Patent Office on Feb. 4, 2009 in connection with related U.S. Appl. No. 10/843,373.81Office Action issued by the U.S. Patent Office on Feb. 9, 2009 in connection with related U.S. Appl. No. 10/843,459.82Office Action issued by the U.S. Patent Office on Jan. 10, 2008 in connection with related U.S. Appl. No. 10/843,373.83Office Action issued by the U.S. Patent Office on Jan. 16, 2009 in connection with related U.S. Appl. No. 10/843,353.84Office Action issued by the U.S. Patent Office on Jan. 21, 2009 in connection with related U.S. Appl. No. 11/493,934.85Office Action issued by the U.S. Patent Office on Jul. 11, 2008 in connection with related U.S. Appl. No. 11/272,034.86Office Action issued by the U.S. Patent Office on Jul. 16, 2007 in connection with related U.S. Appl. No. 10/898,220.87Office Action issued by the U.S. Patent Office on Jul. 28, 2009 in connection with related U.S. Appl. No. 10/843,353.88Office Action issued by the U.S. Patent Office on Jul. 30, 2009 in connection with related U.S. Appl. No. 11/493,934.89Office Action issued by the U.S. Patent Office on Jul. 6, 2009 in connection with related U.S. Appl. No. 10/843,459.90Office Action issued by the U.S. Patent Office on Jul. 7, 2009 in connection with related U.S. Appl. No. 10/843,398.91Office Action issued by the U.S. Patent Office on Jun. 1, 2009 in connection with related U.S. Appl. No. 11/272,035.92Office Action issued by the U.S. Patent Office on Jun. 23, 2009 in connection with related U.S. Appl. No. 11/785,609.93Office Action issued by the U.S. Patent Office on Mar. 12, 2008 in connection with related U.S. Appl. No. 10/843,459.94Office Action issued by the U.S. Patent Office on Mar. 16, 2010 in connection with related U.S. Appl. No. 11/272,035.95Office Action issued by the U.S. Patent Office on Mar. 22, 2010 in connection with related U.S. Appl. No. 11/493,934.96Office Action issued by the U.S. Patent Office on May 14, 2009 in connection with related U.S. Appl. No. 11/272,034.97Office Action issued by the U.S. Patent Office on Nov. 21, 2007 in connection with related U.S. Appl. No. 10/843,398.98Office Action issued by the U.S. Patent Office on Oct. 4, 2007 in connection with related U.S. Appl. No. 10/951,796.99Office Action issued by the U.S. Patent Office on Sep. 26, 2007 in connection with related U.S. Appl. No. 10/843,353.100Office Action issued on Feb. 5, 2008 in connection with the related U.S. Appl. No. 10/843,375.101Office Action mailed Sep. 7, 2010 from the Japan Patent Office for Japanese patent application No. 2007-523639 in connection with related U.S. Appl. No. 10/951,796, now U.S. patent No. 7,496,962 (English translation enclosed).102R. Deraison, et al., "Nessus Network Auditing," Sungress Publishing, Jul. 20, 2004, pp. 1-13.103R. Deraison, et al., "Passive Vulnerability Scanning; Introduction to NeVO," Tenable Network Security, May 30, 2004, pp. 1-13.104R. Gula, "Passive Vulnerability Detection. Techniques to passively find network security vulnerabilities," Sep. 9, 1999 (5 pp.).105R. Hiyoshi, "Practical Guide to Intrusion Detection System: Snort & Tripwire," Japan, Apr. 25, 2004, pp. 57-230 (concise English explanation of relevance attached).106R.P. Lippmann et al., "Passive Operating System Identification from TCP/IP Packet Headers," Proceedings Workshop on Data Mining for Computer Security (DMSEC), Nov. 2003 (10 pp.).107S.Siddharth, "Evading NIDS, revisited" (Dec. 12, 2005).108Spitzner, Lance; Passive Fingerprinting, May 3, 2003; FOCUS on Intrusion Detection; pp. 1-4; obtained from http://www.ctillhq.com/pdfdb/000183/data.pdf.109T. Ptacek, et al., "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection", Jan. 1998, pp. 1-63.110Tarjan, et al., "Storing a Sparse Table," Communications of the ACM (Nov. 1979), vol. 2, No. 11, pp. 606-620.111U. Shankar and V. Paxson, Active Mapping: Resisting NIDS Evasion Without Altering Traffic, Proc. IEEE Symposium on Security and Privacy. May 2003, pp. 1-18.112U.S. Appl. No. 10/843,353, filed May 2004, Roesch et al., System and Method for Determining Characteristics of a Network and Analyzing Vulnerabilities.113U.S. Appl. No. 10/843,373, filed May 2004, Roesch et al., Systems and Methods for Identifying the Services of a Network.114U.S. Appl. No. 10/843,375, filed May 2004, Roesch et al., Systems and Methods for Determining Characteristics of a Network and Assessing Confidence.115U.S. Appl. No. 10/843,398, filed May 2004, Roesch et al., Systems and Methods for Determining Characteristics of a Network.116U.S. Appl. No. 10/843,459, filed May 2004, Roesch et al., Systems and Methods for Determining Characteristics of a Network and Enforcing Policy.117U.S. Appl. No. 10/898,220, filed Jul. 2004, Norton et al., Methods and Systems for Multi-Pattern Searching.118U.S. Appl. No. 10/951,796, filed Sep. 2004, Roelker et al., Intrusion Detection Strategies for Hypertext Transport Protocol.119U.S. Appl. No. 11/272,033, filed Nov. 2005, Dempster et al., Systems and Methods for Identifying the Client Applications of a Network.120U.S. Appl. No. 11/272,034, filed Nov. 2005, Vogel, III et al., Systems and Methods for Modifying Network Map Attributes.121U.S. Appl. No. 11/272,035, filed Nov. 2005, Gustafson et al., Intrusion Event Correlation with Network Discovery Information.122U.S. Appl. No. 11/493,934, filed Jul. 2006, Roesch et al., Device, System and Method for Analysis of Fragments in a Fragment Train.123U.S. Appl. No. 11/501,776, filed Aug. 2006, Roesch et al., Device, System and Method for Analysis of Segments in a Transmission Control Protocol (TCP) Session.124U.S. Appl. No. 11/711,876, filed Feb. 2007, Sturges et al., Device, System and Method for Timestamp Analysis of Segments in a Transmission Control Protocol (TCP) Session.125U.S. Appl. No. 11/785,609, filed Apr. 2007, Norton et al., Methods and Systems for Multi-Pattern Searching.126U.S. Appl. No. 11/905,980, filed Oct. 2007, Roesch, Device, System and Method for use of Micro-Policies in Intrusion Detection/Prevention.127U.S. Appl. No. 12/010,900, filed Jan. 2008, Norton et al., Methods and Systems for Multi-Pattern Searching.128U.S. Appl. No. 12/149,196, filed Apr. 2008, Rittermann, Real-Time User Awareness for a Computer Network.129U.S. Appl. No. 12/230,338, filed Aug. 2008, Sturges et al., Speed and Memory Optimization of Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) Rule Processing.130U.S. Appl. No. 12/813,859, filed Jun. 2010, Polley et al.131V. Jacobson, et al., Request for Comments: 1323, "TCP Extensions for High Performance," May 1992 (35 pages).Referenced byCiting PatentFiling datePublication dateApplicantTitleUS8176557Feb 12, 2009May 8, 2012Architecture Technology CorporationRemote collection of computer forensic evidenceUS8213326 *Apr 30, 2009Jul 3, 2012Alcatel LucentMethod and apparatus for the classification of ports on a data communication network nodeUS8272055Oct 8, 2009Sep 18, 2012Sourcefire, Inc.Target-based SMB and DCE/RPC processing for an intrusion detection system or intrusion prevention systemUS8289882Jan 15, 2010Oct 16, 2012Sourcefire, Inc.Systems and methods for modifying network map attributesUS8458805May 20, 2009Jun 4, 2013Architecture Technology CorporationDigital forensic analysis using empirical privilege profiling (EPP) for filtering collected dataUS8474047May 7, 2012Jun 25, 2013Architecture Technology CorporationRemote collection of computer forensic evidenceUS8489548 *Apr 12, 2010Jul 16, 2013Huawei Technologies Co., Ltd.Method, system, and device for data synchronizationUS20100198783 *Apr 12, 2010Aug 5, 2010Huawei Technologies Co., Ltd.Method, system, and device for data synchronizationUS20100299430 *Jul 15, 2009Nov 25, 2010Architecture Technology CorporationAutomated acquisition of volatile forensic evidence from network devicesUS20110314143 *Jun 22, 2010Dec 22, 2011Sourcefire, Inc.System and method for resolving operating system or service identity conflictsUS20120051346 *Aug 24, 2011Mar 1, 2012Quantenna Communications, Inc.3-address mode bridging* Cited by examinerClassifications U.S. Classification370/235, 709/224, 370/392International ClassificationH04L12/28Cooperative ClassificationH04L67/125, H04L63/1433European ClassificationH04L29/08N11M, H04L63/14CLegal EventsDateCodeEventDescriptionAug 18, 2004ASAssignmentFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:ROESCH, MARTIN;DEMPSTER, RONALD A.;REEL/FRAME:015691/0661Owner name: SOURCEFIRE, INC., MARYLANDEffective date: 20040802RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services©2012 Google