Source: http://www.google.com/patents/US7885190?dq=7,321,221
Timestamp: 2017-09-22 16:18:11
Document Index: 660695200

Matched Legal Cases: ['application No. 07', 'application No. 07015003', 'application No. 07014575', 'application No. 05773501', 'application No. 05773501', 'application No. 2007']

Patent US7885190 - Systems and methods for determining characteristics of a network based on ... - Google Patents
A packet transmitted on a network is read and decoded. A network device and its operating system are identified by analyzing the decoded packet. If more than one operating system is identified from the decoded packet, the operating system is selecting by comparing confidence values assigned to the operating...http://www.google.com/patents/US7885190?utm_source=gb-gplus-sharePatent US7885190 - Systems and methods for determining characteristics of a network based on flow analysis
Publication number US7885190 B1
Application number US 10/843,374
Also published as US7496662, US7716742, US7730175, US7801980, US7949732, US8578002
Publication number 10843374, 843374, US 7885190 B1, US 7885190B1, US-B1-7885190, US7885190 B1, US7885190B1
Patent Citations (132), Non-Patent Citations (131), Referenced by (31), Classifications (8), Legal Events (3)
US 7885190 B1
12 D. Joseph, et al., "A Policy-aware Switching Layer for Data Centers," SIGCOMM, Aug. 17-22, 2008, pp. 51-62.
13 D. Roelker, "HTTP IDS Evasions Revisited" (Aug. 1, 2003) [online] (retrieved on Nov. 9, 2006). Retrieved from the Internet .
14 D. Roelker, "HTTP IDS Evasions Revisited" (Aug. 1, 2003) [online] (retrieved on Nov. 9, 2006). Retrieved from the Internet <URL: http://docs.idsresearch.org/http—ids—evasions.pdf>.
15 European Office Action issued by the European Patent Office on Nov. 28, 2008 in connection with European patent application No. 07 015 003.2-2413, which corresponds to related U.S. Appl. No. 11/501,776.
16 European Search Report issued by the European Patent Office on Dec. 27, 2007 in connection with European patent application No. 07015003.2-2413, which corresponds to related U.S. Appl. No. 11/501,776.
17 European Search Report issued by the European Patent Office on Nov. 22, 2007 in connection with European patent application No. 07014575.0-1244, which corresponds to related U.S. Appl. No. 11/493,934.
18 European Search Report issued by the European Patent Office on Oct. 12, 2009 in connection with European patent application No. 05773501.1-2201, which corresponds to related U.S. Appl. Nos. 10/898,220, 11/785,609 and 12/010,900.
19 Final Office Action issued by the U.S. Patent Office on Aug. 19, 2008 in connection with related U.S. Appl. No. 10/843,373.
20 Final Office Action issued by the U.S. Patent Office on Aug. 20, 2008 in connection with related U.S. Appl. No. 10/843,353.
21 Final Office Action issued by the U.S. Patent Office on Aug. 6, 2008 in connection with related U.S. Appl. No. 10/843,375.
22 Final Office Action issued by the U.S. Patent Office on Dec. 8, 2009 in connection with related U.S. Appl. No. 11/272,034.
23 Final Office Action issued by the U.S. Patent Office on Dec. 9, 2009 in connection with related U.S. Appl. No. 11/272,035.
24 Final Office Action issued by the U.S. Patent Office on Jul. 17, 2008 in connection with related U.S. Appl. No. 10/843,459.
25 Final Office Action issued by the U.S. Patent Office on Jun. 26, 2008 in connection with related U.S. Appl. No. 10/898,220.
26 Final Office Action issued by the U.S. Patent Office on Jun. 4, 2008 in connection with related U.S. Appl. No. 10/843,398.
29 Final Office Action issued by the U.S. Patent Office on Sep. 17, 2010 in connection with related U.S. Appl. No. 11/711,876.
30 Final Office Action issued by the U.S. Patent Office on Sep. 30, 2010 in connection with U.S. Appl. No. 11/493,934.
31 Final Office Action issued by the U.S. Patent Office on Sep. 8, 2010 in connection with related U.S. Appl. No. 10/843,459.
32 Full Band and Matrix Algorithms (Jun. 9, 2004), http://web.archive.org/web20040109154658/http://www.netlib.org/utk/Isi/pcwLSI/text/node150.html.
33 International Preliminary Report on Patentability and Written Opinion of the International Searching Authority mailed on Mar. 17, 2009 in connection with corresponding PCT application No. PCT/US06/43820, which corresponds to related U.S. Appl. No. 11/272,035.
34 International Preliminary Report on Patentability and Written Opinion of the International Searching Authority mailed on Mar. 3, 2009 in connection with PCT application No. PCT/US05/025584, which corresponds to related U.S. Appl. No. 10/898,220.
35 International Preliminary Report on Patentability mailed on Apr. 7, 2009 in connection with PCT application No. PCT/US07/021351, which corresponds to U.S. Appl. No. 11/905,980.
36 International Preliminary Report on Patentability mailed on May 22, 2008 in connection with PCT application No. PCT/US06/43800, which corresponds to U.S. Appl. No. 11/272,034.
37 International Preliminary Report on Patentability mailed on Nov. 12, 2009 in connection with PCT application No. PCT/US08/005466, which corresponds to U.S. Appl. No. 12/149,196.
38 International Preliminary Report on Patentability mailed on Sep. 11, 2009 in connection with PCT application No. PCT/US08/002454, which corresponds to U.S. Appl. No. 11/711,876.
39 International Search Report and Written Opinion of the International Searching Authority issued on Aug. 18, 2008 in connection with PCT application No. PCT/US08/05466, which corresponds to U.S. Appl. No. 12/149,196.
40 International Search Report and Written Opinion of the International Searching Authority issued on Dec. 5, 2007 in connection with PCT application No. PCT/US05/25583, which corresponds to U.S. Appl. No. 10/951,796.
41 International Search Report and Written Opinion of the International Searching Authority issued on Jul. 2, 2008 in connection with PCT application No. PCT/US08/02454, which corresponds to U.S. Appl. No. 11/711,876.
42 International Search Report and Written Opinion of the International Searching Authority issued on Jul. 7, 2008 in connection with PCT application No. PCT/US06/43820, which corresponds to U.S. Appl. No. 11/272,035.
43 International Search Report and Written Opinion of the International Searching Authority issued on Jun. 19, 2008 in connection with PCT application No. PCT/US05/25584, which corresponds to U.S. Appl. No. 10/898,220.
44 International Search Report and Written Opinion of the International Searching Authority issued on Jun. 30, 2008 in connection with PCT application No. PCT/US07/21351, which corresponds to U.S. Appl. No. 11/905,980.
45 International Search Report and Written Opinion of the International Searching Authority issued on Mar. 16, 2010 in connection with PCT application No. PCT/US09/59965, which corresponds to U.S. Appl. No. 12/575,612.
46 International Search Report and Written Opinion of the International Searching Authority issued on Oct. 9, 2007 in connection with PCT application No. PCT/US06/43800, which corresponds to U.S. Appl. No. 11/272,034.
47 International Search Report and Written Opinion of the International Searching Authority mailed on May 27, 2009 in connection with PCT application No. PCT/US09/02210, which corresponds to U.S. Appl. No. 12/230,338.
48 J. Howe, "An Environment for "Sniffing" DCE-RPC Traffic," CITI Technical Report 93-4, Jun. 21, 1993, 12 pages total.
49 J. Novak et al., "Target-Based TCP Stream Reassembly" (Aug. 3, 2007), Revision 1.0, pp. 1-23, obtained from: http://www.snort/org/docs/stream5-modelAUg032007.pdf.
50 J. Novak, "Target-Based Fragmentation Reassembly" (Apr. 2005), Revision 2.0, pp. 1-32.
51 Lyon, Gordon; Remote OS detection via TCP/IP Stack Fingerprinting, Jun. 30, 2002; pp. 1-12; obtained from: http://web.archive.org/web/20021017063625/www.insecure.org/nmap/nmap-fingerprinting-article.html.
52 M. Norton, "Optimizing Pattern Matching for Intrusion Detection" (Jul. 4, 2004) [online] (retrieved on Nov. 9, 2006). Retrieved from the Internet .
53 M. Norton, "Optimizing Pattern Matching for Intrusion Detection" (Jul. 4, 2004) [online] (retrieved on Nov. 9, 2006). Retrieved from the Internet <URL: http://docs.idsresearch.org/OptimizingPatternMatchingForIDS.pdf>.
54 N. Brownlee, et al., "Methodology for Passive Analysis of a University Internet Link," PAM2001 Passive and Active Measurement Workshop, Apr. 2001 (7 pp.).
55 N. Chase, "Active Server pp. 3.0 from Scratch" (Dec. 1999), Searching for products section, 13 pp.
56 Norton et al., "Multi-Patten Search Engine Aho-Corasick State Machine" (Mar. 17, 2004), Version 2.0, 36 pp.
57 Norton et al., "Sourcefire Optimizing Pattern Matching for Intrusion Detection" (Sep. 2004), 14 pp.
58 Notice of Allowance issued by the U.S. Patent Office on Aug. 18, 2008 in connection with related U.S. Appl. No. 11/272,033.
59 Notice of Allowance issued by the U.S. Patent Office on Dec. 8, 2009 in connection with related U.S. Appl. No. 11/501,776.
60 Notice of Allowance issued by the U.S. Patent Office on Feb. 5, 2010 in connection with related U.S. Appl. No. 11/272,034.
61 Notice of Allowance issued by the U.S. Patent Office on Jan. 21, 2009 in connection with related U.S. Appl. No. 10/898,220.
62 Notice of Allowance issued by the U.S. Patent Office on Jan. 7, 2010 in connection with related U.S. Appl. No. 10/843,353.
63 Notice of Allowance issued by the U.S. Patent Office on Jan. 8, 2010 in connection with related U.S. Appl. No. 10/843,373.
64 Notice of Allowance issued by the U.S. Patent Office on Jun. 11, 2009 in connection with related U.S. Appl. No. 10/843,373.
65 Notice of Allowance issued by the U.S. Patent Office on Mar. 5, 2010 in connection with related U.S. Appl. No. 11/785,609.
66 Notice of Allowance issued by the U.S. Patent Office on May 24, 2010 in connection with related U.S. Appl. No. 10/843,398.
67 Notice of Allowance issued by the U.S. Patent Office on Oct. 15, 2008 in connection with related U.S. Appl. No. 10/951,796.
68 Notice of Allowance issued by the U.S. Patent Office on Oct. 21, 2008 in connection with related U.S. Appl. No. 10/843,375.
69 Notice of Allowance issued by the U.S. Patent Office on Oct. 5, 2007 in connection with related U.S. Appl. No. 10/793,887.
70 Notice of Allowance issued by the U.S. Patent Office on Sep. 6, 2007 in connection with related U.S. Appl. No. 10/843,376.
71 Office Action issued by the European Patent Office on Jan. 15, 2010 in connection with European patent application No. 05773501.1-2201, which corresponds to related U.S. Appl. Nos. 10/898,220, 11/785,609 and 12/010,900.
72 Office Action issued by the U.S. Patent Office on Apr. 15, 2010 in connection with related U.S. Appl. No. 12/010,900.
73 Office Action issued by the U.S. Patent Office on Apr. 21, 2010 in connection with related U.S. Appl. No. 10/843,459.
74 Office Action issued by the U.S. Patent Office on Apr. 28, 2009 in connection with related U.S. Appl. No. 11/501,776.
75 Office Action issued by the U.S. Patent Office on Apr. 7, 2010 in connection with related U.S. Appl. No. 11/711,876.
76 Office Action issued by the U.S. Patent Office on Dec. 17, 2008 in connection with related U.S. Appl. No. 10/843,398.
77 Office Action issued by the U.S. Patent Office on Dec. 17, 2009 in connection with related U.S. Appl. No. 11/493,934.
78 Office Action issued by the U.S. Patent Office on Dec. 23, 2008 in connection with related U.S. Appl. No. 11/272,034.
79 Office Action issued by the U.S. Patent Office on Feb. 21, 2008 in connection with related U.S. Appl. No. 11/272,033.
80 Office Action issued by the U.S. Patent Office on Feb. 4, 2009 in connection with related U.S. Appl. No. 10/843,373.
81 Office Action issued by the U.S. Patent Office on Feb. 9, 2009 in connection with related U.S. Appl. No. 10/843,459.
82 Office Action issued by the U.S. Patent Office on Jan. 10, 2008 in connection with related U.S. Appl. No. 10/843,373.
83 Office Action issued by the U.S. Patent Office on Jan. 16, 2009 in connection with related U.S. Appl. No. 10/843,353.
84 Office Action issued by the U.S. Patent Office on Jan. 21, 2009 in connection with related U.S. Appl. No. 11/493,934.
85 Office Action issued by the U.S. Patent Office on Jul. 11, 2008 in connection with related U.S. Appl. No. 11/272,034.
86 Office Action issued by the U.S. Patent Office on Jul. 16, 2007 in connection with related U.S. Appl. No. 10/898,220.
87 Office Action issued by the U.S. Patent Office on Jul. 28, 2009 in connection with related U.S. Appl. No. 10/843,353.
88 Office Action issued by the U.S. Patent Office on Jul. 30, 2009 in connection with related U.S. Appl. No. 11/493,934.
89 Office Action issued by the U.S. Patent Office on Jul. 6, 2009 in connection with related U.S. Appl. No. 10/843,459.
90 Office Action issued by the U.S. Patent Office on Jul. 7, 2009 in connection with related U.S. Appl. No. 10/843,398.
91 Office Action issued by the U.S. Patent Office on Jun. 1, 2009 in connection with related U.S. Appl. No. 11/272,035.
92 Office Action issued by the U.S. Patent Office on Jun. 23, 2009 in connection with related U.S. Appl. No. 11/785,609.
93 Office Action issued by the U.S. Patent Office on Mar. 12, 2008 in connection with related U.S. Appl. No. 10/843,459.
94 Office Action issued by the U.S. Patent Office on Mar. 16, 2010 in connection with related U.S. Appl. No. 11/272,035.
95 Office Action issued by the U.S. Patent Office on Mar. 22, 2010 in connection with related U.S. Appl. No. 11/493,934.
96 Office Action issued by the U.S. Patent Office on May 14, 2009 in connection with related U.S. Appl. No. 11/272,034.
97 Office Action issued by the U.S. Patent Office on Nov. 21, 2007 in connection with related U.S. Appl. No. 10/843,398.
98 Office Action issued by the U.S. Patent Office on Oct. 4, 2007 in connection with related U.S. Appl. No. 10/951,796.
99 Office Action issued by the U.S. Patent Office on Sep. 26, 2007 in connection with related U.S. Appl. No. 10/843,353.
100 Office Action issued on Feb. 5, 2008 in connection with the related U.S. Appl. No. 10/843,375.
101 Office Action mailed Sep. 7, 2010 from the Japan Patent Office for Japanese patent application No. 2007-523639 in connection with related U.S. Appl. No. 10/951,796, now U.S. patent No. 7,496,962 (English translation enclosed).
102 R. Deraison, et al., "Nessus Network Auditing," Sungress Publishing, Jul. 20, 2004, pp. 1-13.
103 R. Deraison, et al., "Passive Vulnerability Scanning; Introduction to NeVO," Tenable Network Security, May 30, 2004, pp. 1-13.
104 R. Gula, "Passive Vulnerability Detection. Techniques to passively find network security vulnerabilities," Sep. 9, 1999 (5 pp.).
105 R. Hiyoshi, "Practical Guide to Intrusion Detection System: Snort & Tripwire," Japan, Apr. 25, 2004, pp. 57-230 (concise English explanation of relevance attached).
106 R.P. Lippmann et al., "Passive Operating System Identification from TCP/IP Packet Headers," Proceedings Workshop on Data Mining for Computer Security (DMSEC), Nov. 2003 (10 pp.).
107 S.Siddharth, "Evading NIDS, revisited" (Dec. 12, 2005).
108 Spitzner, Lance; Passive Fingerprinting, May 3, 2003; FOCUS on Intrusion Detection; pp. 1-4; obtained from http://www.ctillhq.com/pdfdb/000183/data.pdf.
109 T. Ptacek, et al., "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection", Jan. 1998, pp. 1-63.
110 Tarjan, et al., "Storing a Sparse Table," Communications of the ACM (Nov. 1979), vol. 2, No. 11, pp. 606-620.
111 U. Shankar and V. Paxson, Active Mapping: Resisting NIDS Evasion Without Altering Traffic, Proc. IEEE Symposium on Security and Privacy. May 2003, pp. 1-18.
112 U.S. Appl. No. 10/843,353, filed May 2004, Roesch et al., System and Method for Determining Characteristics of a Network and Analyzing Vulnerabilities.
113 U.S. Appl. No. 10/843,373, filed May 2004, Roesch et al., Systems and Methods for Identifying the Services of a Network.
114 U.S. Appl. No. 10/843,375, filed May 2004, Roesch et al., Systems and Methods for Determining Characteristics of a Network and Assessing Confidence.
115 U.S. Appl. No. 10/843,398, filed May 2004, Roesch et al., Systems and Methods for Determining Characteristics of a Network.
116 U.S. Appl. No. 10/843,459, filed May 2004, Roesch et al., Systems and Methods for Determining Characteristics of a Network and Enforcing Policy.
117 U.S. Appl. No. 10/898,220, filed Jul. 2004, Norton et al., Methods and Systems for Multi-Pattern Searching.
118 U.S. Appl. No. 10/951,796, filed Sep. 2004, Roelker et al., Intrusion Detection Strategies for Hypertext Transport Protocol.
119 U.S. Appl. No. 11/272,033, filed Nov. 2005, Dempster et al., Systems and Methods for Identifying the Client Applications of a Network.
120 U.S. Appl. No. 11/272,034, filed Nov. 2005, Vogel, III et al., Systems and Methods for Modifying Network Map Attributes.
121 U.S. Appl. No. 11/272,035, filed Nov. 2005, Gustafson et al., Intrusion Event Correlation with Network Discovery Information.
122 U.S. Appl. No. 11/493,934, filed Jul. 2006, Roesch et al., Device, System and Method for Analysis of Fragments in a Fragment Train.
123 U.S. Appl. No. 11/501,776, filed Aug. 2006, Roesch et al., Device, System and Method for Analysis of Segments in a Transmission Control Protocol (TCP) Session.
124 U.S. Appl. No. 11/711,876, filed Feb. 2007, Sturges et al., Device, System and Method for Timestamp Analysis of Segments in a Transmission Control Protocol (TCP) Session.
125 U.S. Appl. No. 11/785,609, filed Apr. 2007, Norton et al., Methods and Systems for Multi-Pattern Searching.
126 U.S. Appl. No. 11/905,980, filed Oct. 2007, Roesch, Device, System and Method for use of Micro-Policies in Intrusion Detection/Prevention.
127 U.S. Appl. No. 12/010,900, filed Jan. 2008, Norton et al., Methods and Systems for Multi-Pattern Searching.
128 U.S. Appl. No. 12/149,196, filed Apr. 2008, Rittermann, Real-Time User Awareness for a Computer Network.
129 U.S. Appl. No. 12/230,338, filed Aug. 2008, Sturges et al., Speed and Memory Optimization of Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) Rule Processing.
130 U.S. Appl. No. 12/813,859, filed Jun. 2010, Polley et al.
131 V. Jacobson, et al., Request for Comments: 1323, "TCP Extensions for High Performance," May 1992 (35 pages).
U.S. Classification 370/235, 709/224, 370/392
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:ROESCH, MARTIN;DEMPSTER, RONALD A.;REEL/FRAME:015691/0661