Source: http://www.google.co.uk/patents/US8677486
Timestamp: 2017-11-20 00:26:42
Document Index: 520046763

Matched Legal Cases: ['Application No. 61', 'Application No. 61', 'application No. 07', 'application No. 07015003', 'Application No. 2685292', 'Application No. 2007', 'application No. 05773501', 'Application No. 05773501', 'application No. 2007', 'application No. 2007']

Patent US8677486 - System and method for near-real time network attack detection, and system ... - Google Patents
A system includes a processor. The processor is configured to receive network traffic that includes a data block. The processor will generate a unique identifier (UID) for the file that includes a hash value corresponding to the file. The processor will determine whether the file is indicated as good...http://www.google.co.uk/patents/US8677486?utm_source=gb-gplus-sharePatent US8677486 - System and method for near-real time network attack detection, and system and method for unified detection via detection routing
Publication number US8677486 B2
Application number US 13/086,819
Also published as CA2789824A1, EP2559217A1, US20110258702, WO2011130510A1
Publication number 086819, 13086819, US 8677486 B2, US 8677486B2, US-B2-8677486, US8677486 B2, US8677486B2
Patent Citations (243), Non-Patent Citations (199), Referenced by (4), Classifications (9), Legal Events (4)
US 8677486 B2
A system includes a processor. The processor is configured to receive network traffic that includes a data block. The processor will generate a unique identifier (UID) for the file that includes a hash value corresponding to the file. The processor will determine whether the file is indicated as good or bad with the previously-stored UID. The processor will call a file-type specific detection nugget corresponding to the file's file-type to perform a full file inspection to detect whether the file is good or bad and store a result of the inspection together with the UID of the file, when the file is determined to be not listed in the previously-stored UIDs. The processor will not call the file-type specific detection nugget when the file's indicator is “good” or “bad” in the previously-stored UIDs. The processor will issue an alert about the bad file when the file's indicator is “bad”.
a storage device configured to store unique identifiers for data blocks and indications associated with the stored unique identifiers whether each of the data blocks is good or bad;
determine during a packet scan operation on the network traffic of the packet that includes the data block whether the data block is indicated as good or bad in the indications associated with the unique identifier in the storage device;
not call the file-type specific detection nugget when the data block is determined to be indicated as bad in the unique identifier in the storage device, and issue an alert indicating that the data block that was received is bad,
the file-type specific detection nugget is called by
sending a notification to a dispatcher program which indicates both the file-type and that evaluation of the data block as the file-type is desired,
receiving a token from the dispatcher program, in response to the notification, authorizing inspection by the file-type specific detection nugget,
generating an indication of the data block and the token authorizing inspection to the file-type specific detection nugget to commence full file inspection of the data block, in response to receipt of the token, and
providing the data block to the detection nugget, in response to receipt of the token,
wherein there are a plurality of file-type specific detection nuggets each for file inspection of file contents of respective different file-types.
2. The system of claim 1, further comprising a nugget storage that stores the plurality of file-type specific detection nuggets, each of the file-type specific detection nuggets is configured
to determine whether the token authorizing inspection is received and is valid,
to provide the file inspection of the data block in accordance with its respective different file type when the token authorizing inspection specific to the file-type specific detection nugget is received and when the token that is received is determined to be valid,
to not provide a file inspection of the data block when the token that is received is not determined to be valid, and
3. The system of claim 1, wherein the file-type specific detection nugget
creates a unique identifier for a subcomponent of the data block when the subcomponent is found with a different file-type or obfuscation scheme than handled by the file-type specific detection nugget,
calls a different file-type specific detection nugget corresponding to the different file-type of the subcomponent to inspect contents of the subcomponent or to look for the unique identifier of the subcomponent in the storage device so as to detect whether the subcomponent is bad or good, and
stores a result of the subcomponent inspection indicating that the subcomponent is bad and that the data block is bad together with the unique identifier of both the subcomponent and the data block in the storage device, instead of storing the indicator that the data block is good with the unique identifier of the data block in the storage device, when the inspection result of the subcomponent that is found is returned as bad or malicious.
the processor device marks the unique identifier for the data block stored in the storage device with a good indicator as “tainted”, when a new detection capability is added to the file-type specific detection nugget; and
the processor device treats the data block as not being indicated in the computer storage device instead of being indicated as “good” so that the good status of the data block is verified and the “tainted” indicated is replaced after the new detection capability is added, when the data block is indicated as “tainted”.
5. The system of claim 1, wherein the file-type specific detection nugget is configured to perform full file parsing that targets specific pre-determined attack triggering conditions.
6. The system of claim 1, wherein the processor is further configured to provide retroactive alerting based on full file and subcomponent processing.
7. The system of claim 1, wherein the unique identifiers stored in the storage device are obtained by a cryptographic hash calculation from full file contents for the different data blocks as each of the data blocks is received in the network traffic.
8. The system of claim 1, wherein the alert is issued to an anti-virus system attached to a mail-gateway for handling the network traffic received over the mail-gateway that contains the data block that is bad.
9. The system of claim 1, wherein the unique identifiers stored in the storage device are further indicated as “global” when they are unique to all system users, and not marked as “global” when they are unique to an individual and not unique to all system users.
10. The system of claim 1, wherein the processor device is further configured to
receive a declaration of interest in one or more file-types including the file-type from one or more file-type specific detection nuggets, and
receive a declaration of interest in one or more file-types including a file-type of the data block from one or more file-type specific detection components;
determine whether the data block is indicated as good or bad in the indications associated with the unique identifier in the storage device;
call all of the one-or more file-type specific detection components that declared interest in the file-type of the data block so that each of the one or more file-type specific detection components that declared interest in the file-type of the data block will inspect the data block so as to detect whether the file is malicious and each return a result of its own file inspection, and store the result of the full file inspection indicating whether the file is good or bad together with the unique identifier of the data block in the storage device, when the data block is determined to be not indicated in the unique identifier in the storage device;
not call any of the one or more file-type specific detection components when the data block is determined to be indicated as good in the unique identifier in the storage device; and
not call any of the one or more file-type specific detection components when the data block is determined to be indicated as bad in the unique identifier in the storage device, and issue an alert indicating that the data block that was received is bad,
determining during a packet scan operation on the network traffic of the packet that includes the data block whether the data block is indicated as good or bad in the indications associated with the unique identifier in the storage device;
not calling the file-type specific detection nugget when the data block is determined to be indicated as bad in the unique identifier in the storage device, and issue an alert indicating that the data block that was received is bad,
13. The method of claim 12, further comprising storing, in a nugget storage, the plurality of file-type specific detection nuggets, each of the file-type specific detection nuggets is configured
to not provide a file inspection of the data block when the token that is received is determined to not be valid, and
14. The method of claim 12, wherein the file-type specific detection nugget
marking, by the processor device, the unique identifier for the data block stored in the storage device with a good indicator as “tainted”, when a new detection capability is added to the file-type specific detection nugget; and
treating the data block as not being indicated in the computer storage device instead of being indicated as “good” so that the good status of the data block is verified and the “tainted” indicated is replaced after the new detection capability is added, when the data block is indicated as “tainted”.
16. The method of claim 12, further comprising performing, in the file-type specific detection nugget, full file parsing that targets specific pre-determined attack triggering conditions.
17. The method of claim 12, further comprising providing retroactive alerting based on full file and subcomponent processing.
18. The method of claim 12, further comprising obtaining the unique identifiers stored in the storage device by a cryptographic hash calculation from full file contents for the different data blocks as each of the data blocks is received in the network traffic.
19. The method of claim 12, further comprising issuing the alert to an anti-virus system attached to a mail-gateway for handling the network traffic received over the mail-gateway that contains the data block that is bad.
20. The method of claim 12, further comprising indicating the unique identifiers stored in the storage device as “global” when they are unique to all system users, and not marking the unique identifiers stored in the storage device as “global” when they are unique to an individual and not unique to all system users.
22. A non-transitory computer readable medium comprising executable instructions for performing the method of claim 12.
in a storage device, storing unique identifiers for data blocks and indications associated with the stored unique identifiers whether each of the data blocks is good or bad;
in a processor device, capturing data that includes a data block;
determining whether the data block is indicated as good or bad in the indications associated with the unique identifier in the storage device;
calling all of the one-or more file-type specific detection component that declared interest in the file-type of the data block so that each of the one or more file-type specific detection components that declared interest in the file-type of the data block will inspect the data block so as to detect whether the file is malicious and each return a result of its own file inspection, and store the result of the full file inspection indicating whether the file is good or bad together with the unique identifier of the data block in the storage device, when the data block is determined to be not indicated in the unique identifier in the storage device;
not calling any of the one or more file-type specific detection components when the data block is determined to be indicated as good in the unique identifier in the storage device; and
not calling any of the one or more file-type specific detection components when the data block is determined to be indicated as bad in the unique identifier in the storage device, and issuing an alert indicating that the data block that was received is bad,
sending a notification to a dispatcher program which indicates both the file-type and that evaluation of the data block as the tile-type is desired,
24. A non-transitory computer readable medium comprising executable instructions for performing the method of claim 23.
This application claims priority to U.S. Provisional Patent Application No. 61/369,215 filed 30 Jul. 2010, and U.S. Provisional Patent Application No. 61/325,020 filed Apr. 16, 2010, all of which are expressly incorporated herein by reference.
Traditionally the IDS space has attempted to detect attacks in a serial manner, as packets come in. Various technologies were introduced to provide for modeling of network communication behavior (fragmentation, TCP streaming, etc. . . . ). However, the focus has continued to be on speed of processing, in order to keep up with the packet stream.
Furthermore, vendor-specific implementation of data capture and data analysis systems typically do not provide for a mechanism to exchange data, each detection system is discrete, with a limited view of incoming data and no understanding if that data has been evaluated before. This approach fails to take advantage of the full investment made in detection technology and introduces an unnecessary amount of overhead to the system.
In yet another variation, the processor device marks the unique identifier for the data block stored in the storage device with a good indicator as “tainted”, when a new detection capability is added to the file-type specific detection nugget; and the processor device treats the data block as not being indicated in the computer storage device instead of being indicated as “good” so that the good status of the data block is verified and the “tainted” indicated is replaced after the new detection capability is added, when the data block is indicated as “tainted”.
In yet another variation, the unique identifiers stored in the storage device are further indicated as “global” when they are unique to all system users, and not marked as “global” when they are unique to an individual and not unique to all system users.
Participating Snort IDS sensors will activate a preprocessor 145 that will capture metadata as desired for evaluation and alerting: source data (URL/sendmail headers/FTP IP), file size and file name. Based on this information and user configuration, the preprocessor will decide if the file is “interesting”. If it is, then the system begins to pull the file 149 from the network stream.
If, during the course of parsing, the DIN finds additional file types or obfuscation schemes that require separate parsing, the DIN creates a UID of the portion of the file (sub-component) that requires additional processing. It then queries a local cache of known-bad/known good sub-component UIDs 125. If there is no entry in the local cache, then the same query is made to a centralized database. If the subcomponent is determined to be bad, then the DIN provides alert notification to the Dispatcher 129. If the UID is determined to be good, the DIN disregards that subcomponent and continues processing.
Because the UIDs for known-good files, along with the associated metadata are stored, and because each subsequent access to the UID from other sources is stored, the system can alert even after files have been marked good. Whenever there is a detection update in any portion of the system, all known-good entries can be marked as “tainted”. If the file is seen again, the Dispatcher responds negatively to a UID check, because the status of the file is unverified after new detection capability is added. The file is then processed by the system.
The nugget system is also extensible, in that it provides a unified structure of metadata and a simple pointer/size to the file data. Detection systems will simply have to manage receiving the structure and data and determine if they wish to participate in subcomponent processing. An API to register as a nugget can be provided that indicates the type of component a detection engine is capable of inspecting. When multiple, non-overlapping detection is available for a particular file type (multiple AV systems, for example) a unique detection-type flag is set so that the dispatcher knows that the file needs to be sent to more than one DIN type.
The Near Real-Time Detection (NRT) is the result of extensive research by various members of the Vulnerability Research Team into the difficulty of providing detection against file format attacks using the Snort detection engine. The level of sophistication currently demonstrated both by actors described as the “Advanced Persistent Threat” (APT) and publically available exploit frameworks such as Metasploit, CANVAS and Core Impact leaves the VRT with few options to provide detection.
Sensors can be configured to use the NRT system in two different ways. Sensors that actively provide files into the NRT system are known as “participant sensors”. Client sensors will maintain a local cache of known bad URLs and MD5 sums and will contact the Dispatcher to query the central database in the case of a cache failure. They will not, however, pass files into the NRT system for analysis.
Return findings 227, 229, 231, 327, 329, 431 e.g. to the Dispatcher 337, 439.
Procedure—in the following order
In this embodiment, the dispatcher is as discussed above, and also maintains a table of interested detection systems and maintains a list of previously evaluated data. The dispatcher can track data by universally unique identifiers (UUID), allowing for approximately 3×1038 unique data types to be declared. This can allow for an unlimited number of data types to be declared and maintained by the system.
UIDs (in the UID column 503) that are marked as “Global” (in the “Global” column 505) indicate that they are provided as part of the entire system, and that they are unique across all implementations of the system. UIDS that are not marked “Global” are unique to individual enterprises and are not available to the entirety of system users. This system of UIDs provides significant extensibility for enterprise-specific detection needs.
Referring now to FIG. 6, a block diagram illustrating a detection routing table will be discussed and described. The detection routing table ensures that, for any given data type 601, one of each type of detection component (in FIG. 6, “Detection Engine Type” 603, 607, 611) can be linked thereto so as to have an opportunity to evaluate that block of data. Each of the detection engine types 603, 607, 611 can be different. Further, the table maintains an understanding of the number of resources (e.g., available threads for different systems 605, 609, 613) available for a given type of detection component 603, 607, 611, allowing the Dispatcher to direct additional components to come online or to convert existing components to a new type. In FIG. 6, only one data type 601 is illustrated in the detection routing table which is illustrative of plural different data types 601 therein, each with their own tree of detection engine types.
For example, an anti-virus system could have a front-end to the system that declares an interest in PDF files (as in the “description” column FIG. 5, 507) (globally identified as “005d5464-7a44-4907-af57-4 db08a61e13c”). A custom built PDF analyzer could also be tied into the system.
Finally, as a further embodiment, a sandbox system can be tied into the system. A sandbox is a known technique. As the systems come online, for example, or thereafter they can register with the dispatcher that they are interested in PDF files and provides the dispatcher a description of the resources available for detection and what IP/port combination data should be sent to. The dispatcher then builds a defense routing table (sometimes referred to herein as a “data routing table”) for PDF files with entries for each of the three type of detection components.
In the illustration, a source 701 (such as a computer system) transmits a transmission to a destination 709. The transmission can include a file, for example, an FTP file transfer or attached to an e-mail, or the like. In this example, the transmission is transmitted via a network 703, a router 705, and a firewall 707 to the destination 709. The communications to and from the destination 709 can be monitored in accordance with well known techniques by an intrusion detection/prevention system (IDS/IPS) 713, such as with a sensor. Although this illustration provides the IDS/IPS behind the firewall 707, the IDS/IPS can be provided anywhere before the destination 709. Alternatively, the intrusion detection/prevention system 713 can be provided in-line with the destination 709, or can be incorporated into the destination 709. Alternatively, the transmission with the file can follow a reverse path, i.e., from the computer system labeled in this figure as “Destination” 709.
Referring now to FIG. 8, a block diagram illustrating portions of an exemplary computer system according to the first embodiment (including FIG. 2 to FIG. 4) will be discussed and described. The computer system 801, sometimes referred to herein as a “system,” may include one or more controllers 805, which can receive signals from a sensor 803 which senses communications from a network 835 in accordance with known techniques, where the communications are being sent to a target (not illustrated). The controller 805 can include a processor 807, a memory 813, an optional display 809, and/or an optional user input device such as a keyboard 811.
The processor 807 (also referred to from time-to-time as a “processor device”) may comprise one or more microprocessors and/or one or more digital signal processors. The memory 813 may be coupled to the processor 807 and may comprise a read-only memory (ROM), a random-access memory (RAM), a programmable ROM (PROM), and/or an electrically erasable read-only memory (EEPROM). The memory 813 may include multiple memory locations for storing, among other things, an operating system, data and variables 815 for programs executed by the processor 807; computer programs for causing the processor to operate in connection with various functions such as receiving 817 network traffic with a computer file, determining 819 whether the computer file is indicated as a good or bad UID, calling 821 a file-type specific detection nugget when the UID is not in storage, storing 823 a result from the detection nugget that the file is good or bad together with the UID, skipping 825 the detection nugget when the UID of the file is indicated as good, skipping 827 the detection nugget when the UID of the file is indicated as bad and issuing an alert, plural different file-type specific detection nuggets 829, 831 for detecting malicious or bad files, and/or other processing; a local cache for UIDs and good/bad indicators 835 and the URL list 837, a dispatcher cache for UIDs and good/bad indicates 839 and the URL list 841; and a database 833 for other miscellaneous information used by the processor 807. The computer programs may be stored, for example, in ROM or PROM and may direct the processor 807 in controlling the operation of the computer system 801. The programs are overviewed below, but details discussed elsewhere are not necessarily repeated here.
The processor 807 may be programmed for calling 821 a file-type specific detection nugget when the UID is not in storage (or as explained elsewhere is indicated as “tainted”) and hence has not previously been inspected (or if “tainted” was inspected by a subsequently updated detection nugget). The file-type of the file can be determined in accordance with known techniques. The file-type specific detection nugget A, B 827, 829 which corresponds to the file-type of the file can be called to further process the file which is tainted or has not been previously inspected. Detection nuggets are discussed elsewhere in more detail.
Referring now to FIG. 10, a block diagram illustrating portions of an exemplary computer system according to the second embodiment (including FIG. 5 and FIG. 6) will be discussed and described. The computer system 1001, sometimes referred to herein as a “system,” may include one or more controllers 1005, which can sense communications from a network 1035 in accordance with known techniques. The controller 1005 can include a processor 1007, a memory 1013, an optional display 1009, and/or an optional user input device such as a keyboard 1011. The processor 1007 may comprise one or more microprocessors and/or one or more digital signal processors. The memory 1013 may be coupled to the processor 1007 and may comprise a read-only memory (ROM), a random-access memory (RAM), a programmable ROM (PROM), and/or an electrically erasable read-only memory (EEPROM). The memory 1013 may include multiple memory locations for storing, among other things, an operating system, data and variables 1015 for programs executed by the processor 1007; computer programs for causing the processor to operate in connection with various functions such as a data collector to capture 1017 data that includes a computer file, generating 1019 a UID for the computer file, determining 1021 whether the computer file is indicated as a good or bad UID, calling 1023 a file-type specific detection component when the UID is not in storage, storing 1025 a result from the detection nugget that the file is good or bad together with the UID, skipping 1027 the detection when the UID of the file is indicated as good, skipping 1029 the detection when the UID of the file is indicated as bad and issuing an alert, receiving 1031 a declaration of interest in one or more file-types from one or more detection components, plural different file-type specific detection components 1043, 1041 for detecting malicious or bad files, and/or other processing; a local cache for UIDs and good/bad indicators 1035 and the URL list 1037, a dispatcher cache for UIDs and good/bad indicates 1039 and the URL list 1041; a data routing table 1047; and a database 1049 for other miscellaneous information used by the processor 1007. The computer programs may be stored, for example, in ROM or PROM and may direct the processor 1007 in controlling the operation of the computer system 1001. The programs are overviewed below, but most of the details are discussed elsewhere and are not repeated here.
The processor 1007 may be programmed for calling 1023 one or more file-type specific detection components, for the file-type per the data routing table 1047, when the UID is not in storage or is marked as “tainted.”
In overview, the process 1101 can receive 1103 network traffic that includes a computer file, generate 1105 a unique identifier for the computer file, determine 1107 whether the file is indicated as good or bad based on the UID compared to a previously inspected file with the same UID as reflected in storage; if 1109 the file is not marked as “good” or “bad” (such as not present in the UID storage) then call 1111 a file-type specific detection nugget to detect whether the file is malicious and store the result in the UID storage; then, if 1113 the file is indicated as “bad” perform 1115 alerting, logging and take steps to drop the bad file; or otherwise (the file is indicated as “good”) take steps to continue normal processing of the good file. Then, the process 1101 can repeat back to the top, to receive 1103 the next computer file in network traffic.
In overview, the process 1201 can capture 1203 data that includes a computer file, generate 1205 a unique identifier for the computer file, determine 1207 whether the file is indicated as good or bad based on the UID compared to a previously inspected file with the same UID as reflected in storage; only if 1209 the file is not marked as “good” or “bad” (such as not present in the UID storage) then the process 1201 can call 1211 one or more file-type specific detection components that previously declared interest in the file's file-type so as to detect whether the file is malicious, and store the result in the UID storage; then, if 1213 the file is indicated as “bad” the process 1201 can perform 1115 alerting and optional logging and return a resulting indicate that the file is bad; or otherwise (the file is indicated as “good”) take steps to continue normal processing of the good file. Then, the process 1201 can repeat back to the top, to capture 1203 the next computer file in data.
The designation “universally unique identifier” is used herein to indicate an identifier that has a size and uses a generation process that makes it practically impossible for two different items to share the same identifier.
The designation “data block” refers to a block of data which has a pre-defined format with a pre-determined beginning and ending (or length), although not necessarily in a single contiguous string of data. A data block may be one or more elements of a single file, as may be defined by a file-handling system. For example, a pdf document (a file) can include plural data blocks, some of which may be compressed or include other files such as images, and the like.
A “passively detected” packet is defined herein as being one or more packets which were not elicited or initiated by the host on which the packet is read. To “passively detect” a packet is to receive a packet which was not elicited or initiated by a prior transmission from the processor on which the packet is read. An “actively identified” packet is defined herein as being one or more packets which were elicited or initiated by the host on which the packet is read, for example, by the host on which the packet is read pinging the host which is in the report.
US7805482 30 Dec 2005 28 Sep 2010 Senactive It-Dienstleistungs Gmbh Method of correlating events in data packet streams
US7904942 * 22 Feb 2008 8 Mar 2011 Inventec Corporation Method of updating intrusion detection rules through link data packet
US20020144142 3 Apr 2001 3 Oct 2002 Dalia Shohat Automatic creation of roles for a role-based access control system
US20070150948 * 24 Dec 2004 28 Jun 2007 Kristof De Spiegeleer Method and system for identifying the content of files in a network
US20100268834 16 Apr 2010 21 Oct 2010 Empirix Inc. Method For Embedding Meta-Commands in Normal Network Packets
WO2004100011A Title not available
4 "Snort™ Users Manual 2.2.0RC1," The Snort Project, Jun. 28, 2004, Retrieved from the Internet: URL:http://cvs.snort.org/viewcvs.cgi/*checkout*/snort/doc/snort—manual.pdf?rev=1.25&content-type=application/pdf [retrieved on Nov. 18, 2010] (XP002610157).
8 "Toupper( )-convert lowercase character to uppercase," http://www.mkssoftware.com, printed on Sep. 20, 2008 from http://web.archive.org, archive date Jun. 30, 2006, 2 pp.
9 "Toupper( )—convert lowercase character to uppercase," http://www.mkssoftware.com, printed on Sep. 20, 2008 from http://web.archive.org, archive date Jun. 30, 2006, 2 pp.
23 * Etienne et al., "Malicious Traffic Detection in Local Networks with Snort", 2009 http://infoscience.epfl.ch/record/141022.
24 European Office Action issued by the European Patent Office on Nov. 28, 2008 in connection with European patent application No. 07 015 003.2-2413, which corresponds to related U.S. Appl. No. 11/501,776.
25 European Search Report issued by the European Patent Office on Dec. 27, 2007 in connection with European patent application No. 07015003.2-2413, which corresponds to related U.S. Appl. No. 11/501,776.
34 Final Office Action issued by the U.S. Patent Office on Dec. 8, 2009 in connection with related U.S. Appl. No. 11/272,034.
38 Final Office Action issued by the U.S. Patent Office on Jun. 10, 2013 in connection with related U.S. Appl. No. 13/046,127.
39 Final Office Action issued by the U.S. Patent Office on Jun. 26, 2008 in connection with related U.S. Appl. No. 10/898,220.
40 Final Office Action issued by the U.S. Patent Office on Jun. 4, 2008 in connection with related U.S. Appl. No. 10/843,398.
41 Final Office Action issued by the U.S. Patent Office on Jun. 5, 2012 in connection with related U.S. Appl. No. 12/813,859.
42 Final Office Action issued by the U.S. Patent Office on Mar. 17, 2010 in connection with related U.S. Appl. No. 10/843,374.
54 Francois Gagnon et al.: "A Hybrid Approach to Operating System Discovery using Answer Set Programming", Integrated Network Management, 2007. IM'07, 10th IFIP/IEEE International Symposium on, IEEE, PI, May 1, 2007, pp. 391-400, XP031182713, ISBN: 978-1-4244-0798-9, p. 293, 394-397.
57 International Preliminary Report on Patentability and Written Opinion of the International Searching Authority mailed on Mar. 17, 2009 in connection with corresponding PCT application No. PCT/US06/43820, which corresponds to related U.S. Appl. No. 11/272,035.
58 International Preliminary Report on Patentability and Written Opinion of the International Searching Authority mailed on Mar. 3, 2009 in connection with PCT application No. PCT/US05/025584, which corresponds to U.S. Appl. No. 10/898,220.
59 International Preliminary Report on Patentability and Written Opinion of the International Searching Authority mailed on Sep. 26, 2013 in connection with PCT application No. PCT/US2012/021633, which corresponds to related U.S. Appl. No. 13/046,127.
60 International Preliminary Report on Patentability mailed by the International Bureau of WIPO on Jan. 10, 2013, in connection with corresponding PCT international application No. PCT/US2011/035874, which corresponds to related U.S. Appl. No. 12/820,227.
61 International Preliminary Report on Patentability mailed by the International Bureau of WIPO on Oct. 26, 2012, in connection with corresponding PCT application No. PCT/US2011/032489.
62 International Preliminary Report on Patentability mailed on Apr. 7, 2009 in connection with PCT application no. PCT/US07/021351, which corresponds to U.S. Appl. No. 11/905,980.
63 International Preliminary Report on Patentability mailed on May 22, 2008 in connection with PCT application No. PCT/US06/43800, which corresponds to U.S. Appl. No. 11/272,034.
64 International Preliminary Report on Patentability mailed on Nov. 12, 2009 in connection with PCT application No. PCT/US08/005466, which corresponds to U.S. Appl. No. 12/149,196.
65 International Preliminary Report on Patentability mailed on Oct. 19, 2010 in connection with PCT application No. PCT/US2009/02210, which corresponds to U.S. Appl. No. 12/230,338.
66 International Preliminary Report on Patentability mailed on Sep. 11, 2009 in connection with PCT application No. PCT/US08/002454, which corresponds to U.S. Appl. No. 11/711,876.
67 International Search Report and Written Opinion of the International Searching Authority issued on Apr. 25, 2012 in connection with PCT application No. PCT/US2012/021633, which corresponds to U.S. Appl. No. 13/046,127.
68 International Search Report and Written Opinion of the International Searching Authority issued on Aug. 18, 2008 in connection with PCT application No. PCT/US08/05466, which corresponds to U.S. Appl. No. 12/149,196.
69 International Search Report and Written Opinion of the International Searching Authority issued on Dec. 5, 2007 in connection with PCT application No. PCT/US05/25583, which corresponds to U.S. Appl. No. 10/951,796.
70 International Search Report and Written Opinion of the International Searching Authority issued on Jul. 2, 2008 in connection with PCT application No. PCT/US08/02454, which corresponds to U.S. Appl. No. 11/711,876.
71 International Search Report and Written Opinion of the International Searching Authority issued on Jul. 28, 2011 in connection with PCT application No. PCT/US2011/032489, which corresponds to the present U.S. Appl. No. 13/086,819.
72 International Search Report and Written Opinion of the International Searching Authority issued on Jul. 7, 2008 in connection with PCT application No. PCT/US06/43820, which corresponds to U.S. Appl. No. 11/272,035.
73 International Search Report and Written Opinion of the International Searching Authority issued on Jun. 19, 2008 in connection with PCT application No. PCT/US05/25584, which corresponds to U.S. Appl. No. 10/898,220.
74 International Search Report and Written Opinion of the International Searching Authority issued on Jun. 30, 2008 in connection with PCT application No. PCT/US07/21351, which corresponds to U.S. Appl. No. 11/905,980.
75 International Search Report and Written Opinion of the International Searching Authority issued on Mar. 16, 2010 in connection with PCT application No. PCT/US09/59965, which corresponds to U.S. Appl. No. 12/575,612.
76 International Search Report and Written Opinion of the International Searching Authority issued on Oct. 9, 2007 in connection with PCT application No. PCT/US06/43800, which corresponds to U.S. Appl. No. 11/272,034.
77 International Search Report and Written Opinion of the International Searching Authority issued on Sep. 1, 2011 in connection with PCT application No. PCT/US2011/035874, which corresponds to U.S. Appl. No. 12/820,227.
78 International Search Report and Written Opinion of the International Searching Authority mailed on May 27, 2009 in connection with PCT application No. PCT/US09/02210, which corresponds to U.S. Appl. No. 12/230,338.
79 J. Howe, "An Environment for "Sniffing" DCE-RPC Traffic," CITI Technical Report 93-4, Jun. 21, 1993, 12 pages total.
80 J. Novak et al., "Target-Based TCP Stream Reassembly" (Aug. 3, 2007), Revision 1.0, pp. 1-23, obtained from: http://www.snort/org/docs/stream5-mode1AUg032007.pdf.
81 J. Novak, "Target-Based Fragmentation Reassembly" (Apr. 2005), Revision 2.0, pp. 1-32.
82 * Kipp et al., "Using Snort as an IDS and Network Monitor in Linux", 2009, 1-4 http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.3.616&rep=rep1&type=pdf.
83 L. Spitzner, "Passive Fingerprinting," FOCUS on Intrusion Detection: Passive Fingerprinting (May 3, 2000), pp. 1-4; obtained from: http://www.stillhq.com/pdfdb/000183/data.pdf.
84 Li, Zhichun, et al. Netshield: Matching with a large vulnerability signature ruleset for high performance network defense. Technical Report NWU-EECS-08-07, Northwestern University, Aug. 2010.
85 M. Norton, "Optimizing Pattern Matching for Intrusion Detection" (Jul. 4, 2004) [online] (retrieved on Nov. 9, 2006). Retrieved from the Internet .
86 M. Norton, "Optimizing Pattern Matching for Intrusion Detection" (Jul. 4, 2004) [online] (retrieved on Nov. 9, 2006). Retrieved from the Internet <URL: http://docs.idsresearch.org/OptimizingPatternMatchingForIDS.pdf>.
87 M. Norton, et al., "The New Snort," Computer Security Journal, CSI Security Institute, XIX, No. 3 (Jan. 1, 2003), pp. 37-47, ISSN: 0277-0865 (XP008039475).
88 * Martin Roesch, "Snort-Lightwieght Intrusion Detection for Networks", Proceedings of LISA '99: 13th System Administration Conference, Nov. 12, 1999, pp. 229-238 http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.105.6212.
89 Matthew Olney et al.: "What would you do with a pointer and a size? A New Detection Framework", Apr. 22, 2010 (Apr. 2, 2010), XP55002567, http://labs.snort.org,/nrt/sfvrt-nrt.pdf (retrieved on Jul. 12, 2011) the whole document.
90 N. Brownlee, et al., "Methodology for Passive Analysis of a University Internet Link," PAM2001 Passive and Active Measurement Workshop, Apr. 2001 (7 pp.).
91 N. Chase, "Active Server Pages 3.0 from Scratch" (Dec. 1999), Searching for products section, 13 pp.
92 Norton et al., "Multi-Patten Search Engine Aho-Corasick State Machine" (Mar. 17, 2004), Version 2.0, 36 pp.
93 Norton et al., "Sourcefire Optimizing Pattern Matching for Intrusion Detection" (Sep. 2004), 14 pp.
94 Notice of Allowance issued by the Canadian Intellectual Property Office on Apr. 19, 2013 in connection with Canada Patent Application No. 2685292, which corresponds to related U.S. Appl. No. 12/820,227.
95 Notice of Allowance issued by the Japanese Patent Office on Sep. 30, 2011 in connection with Japanese Patent Application No. 2007-523640, which corresponds to related U.S. Appl. No. 10/898,220, now U.S. Patent No. 7,539,681.
96 Notice of Allowance issued by the U.S. Patent Office on Apr. 6, 2011 in connection with related U.S. Appl. No. 12/010,900.
97 Notice of Allowance issued by the U.S. Patent Office on Aug. 13, 2013 in connection with related U.S. Appl. No. 13/046,127.
98 Notice of Allowance issued by the U.S. Patent Office on Aug. 18, 2008 in connection with related application U.S. Appl. No. 11/272,033.
99 Notice of Allowance issued by the U.S. Patent Office on Dec. 8, 2009 in connection with related U.S. Appl. No. 11/501,776.
100 Notice of Allowance issued by the U.S. Patent Office on Feb. 24, 2011 in connection with related U.S. Appl. No. 11/493,934.
101 Notice of Allowance issued by the U.S. Patent Office on Feb. 5, 2010 in connection with related U.S. Appl. No. 11/272,034.
102 Notice of Allowance issued by the U.S. Patent Office on Jan. 21, 2009 in connection with related U.S. Appl. No. 10/898,220.
103 Notice of Allowance issued by the U.S. Patent Office on Jan. 24, 2011 in connection with related U.S. Appl. No. 10/843,459.
104 Notice of Allowance issued by the U.S. Patent Office on Jan. 7, 2010 in connection with related U.S. Appl. No. 10/843,353.
105 Notice of Allowance issued by the U.S. Patent Office on Jan. 8, 2010 in connection with related U.S. Appl. No. 10/843,373.
106 Notice of Allowance issued by the U.S. Patent Office on Jan. 9, 2013 in connection with related U.S. Appl. No. 12/813,859.
107 Notice of Allowance issued by the U.S. Patent Office on Jul. 12, 2013 in connection with related U.S. Appl. No. 12/969,682.
108 Notice of Allowance issued by the U.S. Patent Office on Jul. 22, 2011 in connection with related U.S. Appl. No. 11/711,876.
109 Notice of Allowance issued by the U.S. Patent Office on Jun. 11, 2009 in connection with related U.S. Appl. No. 10/843,373.
110 Notice of Allowance issued by the U.S. Patent Office on Jun. 22, 2011 in connection with related U.S. Appl. No. 11/272,035.
111 Notice of Allowance issued by the U.S. Patent Office on Jun. 25, 2012 in connection with related U.S. Appl. No. 12/688,400.
112 Notice of Allowance issued by the U.S. Patent Office on Mar. 14, 2013 in connection with related U.S. Appl. No. 12/230,338.
113 Notice of Allowance issued by the U.S. Patent Office on Mar. 5, 2010 in connection with related U.S. Appl. No. 11/785,609.
114 Notice of Allowance issued by the U.S. Patent Office on May 24, 2010 in connection with related U.S. Appl. No. 10/843,398.
115 Notice of Allowance issued by the U.S. Patent Office on May 30, 2012 in connection with related U.S. Appl. No. 12/575,612.
116 Notice of Allowance issued by the U.S. Patent Office on Oct. 15, 2008 in connection with related U.S. Appl. No. 10/951,796.
117 Notice of Allowance issued by the U.S. Patent Office on Oct. 21, 2008 in connection with related U.S. Appl. No. 10/843,375.
118 Notice of Allowance issued by the U.S. Patent Office on Oct. 5, 2007 in connection with related U.S. Appl. No. 10/793,887.
119 Notice of Allowance issued by the U.S. Patent Office on Oct. 5, 2010 in connection with related U.S. Appl. No. 10/843,374.
120 Notice of Allowance issued by the U.S. Patent Office on Sep. 6, 2007 in connection with related U.S. Appl. No. 10/843,376.
121 Notice of Allowance issued the by U.S. Patent Office on Oct. 28, 2011 in connection with related U.S. Appl. No. 12/149,196.
122 Office Action issued by the European Patent Office on Jan. 15, 2010 in connection with European patent application No. 05773501.1-2201, which corresponds to related U.S. Appl. No. 10/898,220, U.S. Appl. No. 11/785,609 and U.S. Appl. No. 12/010,900.
123 Office Action issued by the European Patent Office on Mar. 20, 2013 in connection with European Patent Application No. 05773501.1-1952 which corresponds to related U.S. Appl. No. 10/898,220 (now patent No. 7,539,631).
124 Office Action issued by the U.S. Patent Office on Apr. 13, 2011 in connection with related U.S. Appl. No. 12/230,338.
125 Office Action issued by the U.S. Patent Office on Apr. 15, 2010 in connection with related U.S. Appl. No. 12/010,900.
126 Office Action issued by the U.S. Patent Office on Apr. 21, 2010 in connection with parent U.S. Appl. No. 10/843,459.
127 Office Action issued by the U.S. Patent Office on Apr. 28, 2009 in connection with related U.S. Appl. No. 11/501,776.
128 Office Action issued by the U.S. Patent Office on Apr. 6, 2011 in connection with related U.S. Appl. No. 11/711,876.
129 Office Action issued by the U.S. Patent Office on Apr. 7, 2010 in connection with related U.S. Appl. No. 11/711,876.
130 Office Action issued by the U.S. Patent Office on Aug. 20, 2009 in connection with related U.S. Appl. No. 10/843,374.
131 Office Action issued by the U.S. Patent Office on Dec. 17, 2008 in connection with related U.S. Appl. No. 10/843,398.
132 Office Action issued by the U.S. Patent Office on Dec. 17, 2009 in connection with related U.S. Appl. No. 11/493,934.
133 Office Action issued by the U.S. Patent Office on Dec. 22, 2010 in connection with related U.S. Appl. No. 11/905,908.
134 Office Action issued by the U.S. Patent Office on Dec. 23, 2008 in connection with related U.S. Appl. No. 11/272,034.
135 Office Action issued by the U.S. Patent Office on Feb. 15, 2012 in connection with related U.S. Appl. No. 12/230,338.
136 Office Action issued by the U.S. Patent Office on Feb. 15, 2012 in connection with related U.S. Appl. No. 12/820,227.
137 Office Action issued by the U.S. Patent Office on Feb. 2, 2012 in connection with related U.S. Appl. No. 12/688,400.
138 Office Action issued by the U.S. Patent Office on Feb. 21, 2008 in connection with related U.S. Appl. No. 11/272,033.
139 Office Action issued by the U.S. Patent Office on Feb. 4, 2009 in connection with related U.S. Appl. No. 10/843,373.
140 Office Action issued by the U.S. Patent Office on Feb. 5, 2008 in connection with related U.S. Appl. No. 10/843,375.
141 Office Action issued by the U.S. Patent Office on Feb. 8, 2013 in connection with related U.S. Appl. No. 13/046,127.
142 Office Action issued by the U.S. Patent Office on Feb. 9, 2009 in connection with parent U.S. Appl. No. 10/843,459.
143 Office Action issued by the U.S. Patent Office on Jan. 10, 2008 in connection with related U.S. Appl. No. 10/843,373.
144 Office Action issued by the U.S. Patent Office on Jan. 10, 2013 in connection with related U.S. Appl. No. 12/969,682.
145 Office Action issued by the U.S. Patent Office on Jan. 16, 2009 in connection with related U.S. Appl. No. 10/843,353.
146 Office Action issued by the U.S. Patent Office on Jan. 21, 2009 in connection with related U.S. Appl. No. 11/493,934.
147 Office Action issued by the U.S. Patent Office on Jul. 11, 2008 in connection with related U.S. Appl. No. 11/272,034.
148 Office Action issued by the U.S. Patent Office on Jul. 16, 2007 in connection with related U.S. Appl. No. 10/898,220.
149 Office Action issued by the U.S. Patent Office on Jul. 28, 2009 in connection with related U.S. Appl. No. 10/843,353.
150 Office Action issued by the U.S. Patent Office on Jul. 30, 2009 in connection with related U.S. Appl. No. 11/493,934.
151 Office Action issued by the U.S. Patent Office on Jul. 6, 2009 in connection with parent U.S. Appl. No. 10/843,459.
152 Office Action issued by the U.S. Patent Office on Jul. 7, 2009 in connection with related U.S. Appl. No. 10/843,398.
153 Office Action issued by the U.S. Patent Office on Jun. 1, 2009 in connection with related U.S. Appl. No. 11/272,035.
154 Office Action issued by the U.S. Patent Office on Jun. 23, 2009 in connection with related U.S. Appl. No. 11/785,609.
155 Office Action issued by the U.S. Patent Office on Mar. 12, 2008 in connection with parent U.S. Appl. No. 10/843,459.
156 Office Action issued by the U.S. Patent Office on Mar. 16, 2010 in connection with related U.S. Appl. No. 11/272,035.
157 Office Action issued by the U.S. Patent Office on Mar. 19, 2012 in connection with related U.S. Appl. No. 12/813,859.
158 Office Action issued by the U.S. Patent Office on Mar. 20, 2008 in connection with related U.S. Appl. No. 10/843,374.
159 Office Action issued by the U.S. Patent Office on Mar. 22, 2010 in connection with related U.S. Appl. No. 11/493,934.
160 Office Action issued by the U.S. Patent Office on Mar. 5, 2012 in connection with related U.S. Appl. No. 12/968,682.
161 Office Action issued by the U.S. Patent Office on May 12, 2011 in connection with related U.S. Appl. No. 12/149,196.
162 Office Action issued by the U.S. Patent Office on May 14, 2009 in connection with related U.S. Appl. No. 11/272,034.
163 Office Action issued by the U.S. Patent Office on May 31, 2011 in connection with related U.S. Appl. No. 12/688,400.
164 Office Action issued by the U.S. Patent Office on May 6, 2013 in connection with related U.S. Appl. No. 12/820,227.
165 Office Action issued by the U.S. Patent Office on Nov. 19, 2010 in connection with parent U.S. Appl. No. 10/843,459.
166 Office Action issued by the U.S. Patent Office on Nov. 21, 2007 in connection with related U.S. Appl. No. 10/843,398.
167 Office Action issued by the U.S. Patent Office on Nov. 6, 2012 in connection with related U.S. Appl. No. 12/820,227.
168 Office Action issued by the U.S. Patent Office on Oct. 15, 2012 in connection with related U.S. Appl. No. 12/230,338.
169 Office Action issued by the U.S. Patent Office on Oct. 21, 2011 in connection with related U.S. Appl. No. 12/969,682.
170 Office Action issued by the U.S. Patent Office on Oct. 4, 2007 in connection with related U.S. Appl. No. 10/951,796.
171 Office Action issued by the U.S. Patent Office on Oct. 6, 2008 in connection with related U.S. Appl. No. 10/843,374.
172 Office Action issued by the U.S. Patent Office on Sep. 26, 2007 in connection with related U.S. Appl. No. 10/843,353.
173 Office Action issued by the U.S. Patent Office on Sep. 6, 2007 in connection with related U.S. Appl. No. 10/843,374.
174 Office Action mailed Mar. 1, 2011 from the Japan Patent Office for Japanese patent application No. 2007-523640 in connection with related U.S. Appl. No. 10/898,220, now U.S. patent no. 7,539,681, U.S. Appl. No. 11/785,609, now U.S. patent No. 7,756,885, and U.S. Appl. No. 12/010,900 (English translation enclosed).
175 Office Action mailed Sep. 7, 2010 from the Japan Patent Office for Japanese patent application No. 2007-523639 in connection with related U.S. Appl. No. 10/951,796, now U.S. patent No. 7,496,962 (English translation enclosed).
176 PCT International Preliminary Report on Patentability mailed on Apr. 21, 2011 by the International Bureau of WIPO in connection with PCT patent application No. PCT/US2009/059965, which corresponds to U.S. Appl. No. 12/575,612.
177 Press Release, "FaceTime Protects Enterprises from Information Leaks over Collaborative Suites like Microsoft OCS and IBM Sametime", issued by FaceTime Communications, Belmont, California, Jul. 14, 2008, retrieved from www.facetime.com/pr/pr080714.aspx , Dec. 1, 2009.
178 R. Deraison, et al., "Nessus Network Auditing," Sungress Publishing, Jul. 20, 2004, pp. 1-13.
179 R. Deraison, et al., "Passive Vulnerability Scanning: Introduction to NeVO," Tenable Network Security, May 30, 2004, pp. 1-13.
180 R. Gula, "Passive Vulnerability Detection. Techniques to passively find network security vulnerabilities," Sep. 9, 1999 (5 pp).
181 R. Hiyoshi, "Practical Guide to Intrusion Detection System: Snort & Tripwire," Japan, Apr. 25, 2004, pp. 57-230 (concise English explanation of relevance attached).
182 R.P. Lippmann et al., "Passive Operating System Identification from TCP/IP Packet Headers," Proceedings Workshop on Data Mining for Computer Security (DMSEC), Nov. 2003 (10 pp.).
183 S.Siddharth, "Evading NIDS, revisited" (Dec. 12, 2005).
184 T. Ptacek, et al., "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection", Jan. 1998, pp. 1-63.
185 Taleck, Greg. "Ambiguity Resolution via Passive OS Fingerprinting." Recent Advances in Intrusion Detection. Springer-Verlag Berlin Heidelberg, 2003.
186 Tarjan, et al., "Storing a Sparse Table," Communications of the ACM (Nov. 1979), vol. 2, No. 11, pp. 606-620.
187 * Tool et al., "Intrusion Detection Systems", Information Assurance tools Report; 6th edition, Sep. 2009, 1-87 http://iac.dtic.mil/csiac/download/intrusion-detection.pdf.
188 * Tool et al., "Intrusion Detection Systems", Information Assurance tools Report; 6th edition, Sep. 2009, 1-87 http://iac.dtic.mil/csiac/download/intrusion—detection.pdf.
189 Tu, William, et al. "Automated Service Discovery for Enterprise Network Management." Mar. 8, 2009.
190 U. Shankar and V. Paxson, Active Mapping: Resisting NIDS Evasion Without Altering Traffic, Proc. IEEE Symposium on Security and Privacy. May 2003, pp. 1-18.
191 U.S. Appl. No. 10/843,374, filed May 2004, Roesch et al., System and Methods for Determining Characteristics of a Network Based on Flow Analysis.
192 U.S. Appl. No. 12/813,859, filed Jun. 2010, Polley et al., System and Method for Assigning Network Blocks to Sensors.
193 U.S. Appl. No. 12/820,227, filed Jun. 2010, Vogel III et al., System and Method for Resolving Operating System or Service Identity Conflicts.
194 U.S. Appl. No. 12/969,682, filed Dec. 2010, Roesch et al., Systems and Methods for Determining Characteristics of a Network and Enforcing Policy.
195 U.S. Appl. No. 13/046,127, filed Mar. 2011, Roesch, System and Method for Real Time Data Awareness.
196 U.S. Appl. No. 13/779,851, filed Feb. 28, 2013, Polley et al.
197 U.S. Appl. No. 14/013,344, filed Aug. 29, 2013, Roesch.
198 V. Jacobson, et al., Request for Comments: 1323, "TCP Extensions for High Performance," May 1992 (35 pages).
199 V. Yegneswaran, et al., "Internet Sieve: An Architecture for Generating Resilient Signatures," May 2004, Retrieved from the Internet: URL:http://www.cc.gatech.edu/˜giffin/papers/tr1507/tr1507.pdf [retrieved on Nov. 18, 2010] (XP002610154).
US9419986 * 26 Mar 2014 16 Aug 2016 Symantec Corporation System to identify machines infected by malware applying linguistic analysis to network requests from endpoints
US9692772 8 Feb 2016 27 Jun 2017 Symantec Corporation Detection of malware using time spans and periods of activity for network requests
US20150281257 * 26 Mar 2014 1 Oct 2015 Symantec Corporation System to identify machines infected by malware applying linguistic analysis to network requests from endpoints
U.S. Classification 726/23, 726/24, 726/22, 726/11, 726/13
Cooperative Classification H04L63/0218, G06F21/564, H04L63/1408
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:OLNEY, MATTHEW;MULLEN, PATRICK;GRENIER, LURENE;AND OTHERS;REEL/FRAME:026128/0010