Source: http://www.google.co.uk/patents/US7801980
Timestamp: 2013-05-19 05:29:43
Document Index: 387445311

Matched Legal Cases: ['application No. 07', 'application No. 07015003', 'application No. 07014575', 'application No. 07014575', 'application No. 05773501', 'application No. 05773501']

Patent US7801980 - Systems and methods for determining characteristics of a network - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Advanced Patent Search | Web History | Sign inAdvanced Patent SearchPatentsA packet transmitted on a network is read and decoded. A network device and its operating system are identified by analyzing the decoded packet. If more than one operating system is identified from the decoded packet, the operating system is selecting by comparing confidence values assigned to the operating...http://www.google.co.uk/patents/US7801980?utm_source=gb-gplus-sharePatent US7801980 - Systems and methods for determining characteristics of a networkPublication numberUS7801980 B1Publication typeGrantApplication number10/843,398Publication date21 Sep 2010Filing date12 May 2004Priority date12 May 2003Also published asUS7496662US7716742US7730175US7885190US7949732InventorsRonald A. DempsterJudy NovakMartin RoeschOriginal AssigneeSourcefire, Inc.U.S. Classification709/224International ClassificationG06F15/16G06F15/173Cooperative ClassificationH04L29/08567H04L63/1433European ClassificationH04L 63/14CH04L 29/08N11MReferencesPatent Citations (103)Non-Patent Citations (126)Referenced by (3)External LinksUSPTOUSPTO AssignmentEspacenetSystems and methods for determining characteristics of a networkUS 7801980 B1Abstract A packet transmitted on a network is read and decoded. A network device and its operating system are identified by analyzing the decoded packet. If more than one operating system is identified from the decoded packet, the operating system is selecting by comparing confidence values assigned to the operating systems identified. A service running on the network device is identified from the decoded packet or subsequent packets that are read, decoded and analyzed. The network topology of a network is determined by reading, decoding, and analyzing a plurality of packets. A flow between two network devices is determined by reading, decoding, and analyzing a plurality of packets. Vulnerabilities are assigned to operating systems and services identified by reading, decoding, and analyzing packets. Network configuration policy is enforced on operating systems and services identified by reading, decoding, and analyzing packets.
Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS455043626 Jul 198329 Oct 1985At&T Bell LaboratoriesParallel text matching methods and apparatusUS45701576 Dec 198311 Feb 1986Uro Denski Kogyo, K.K.Infrared intrusion alarm system capable of preventing false signalsUS485791227 Jul 198815 Aug 1989The United States Of America As Represented By The Secretary Of The NavyIntelligent security assessment systemUS491274823 Sep 198827 Mar 1990Matsushita Electric Works, Ltd.Infrared intrusion detector with a plurality of infrared ray detecting elementsUS498586330 Jul 199015 Jan 1991Hitachi, Ltd.Document storage and retrieval systemUS519319223 Aug 19909 Mar 1993Supercomputer Systems Limited PartnershipVectorized LR parsing of computer programsUS522208128 Jun 199122 Jun 1993Universal Data Systems, Inc.Method of performing an autobaud function using a state flow machineUS54044881 Oct 19934 Apr 1995Lotus Development CorporationRealtime data feed engine for updating an application with the most currently received data from multiple data feedsUS543084229 May 19924 Jul 1995Hewlett-Packard CompanyInsertion of network data checksums by a network adapterUS545984128 Dec 199317 Oct 1995At&T Corp.Finite state machine with minimized vector processingUS549746325 Sep 19925 Mar 1996Bull Hn Information Systems Inc.Ally mechanism for interconnecting non-distributed computing environment (DCE) and DCE systems to operate in a network systemUS560491017 Oct 198918 Feb 1997Hitachi, Ltd.Method of and vector processor for searching text for key words based on candidate character strings obtained from the text using parallel processingUS56662933 Jul 19959 Sep 1997Bell Atlantic Network Services, Inc.Downloading operating system software through a broadcast channelUS579694221 Nov 199618 Aug 1998Computer Associates International, Inc.Method and apparatus for automated network-wide surveillance and security breach interventionUS58705541 Apr 19969 Feb 1999Advanced Micro Devices, Inc.Server selection method where a client selects a server according to address, operating system and found frame for remote bootingUS590130722 Jul 19964 May 1999International Business Machines CorporationProcessor having a selectively configurable branch prediction unit that can access a branch prediction utilizing bits derived from a plurality of sourcesUS591782121 Dec 199429 Jun 1999Newbridge Networks CorporationLook-up engine for packet-based networkUS59192578 Aug 19976 Jul 1999Novell, Inc.Networked workstation intrusion detection systemUS596394224 Dec 19965 Oct 1999Fujitsu LimitedPattern search apparatus and methodUS598747329 Dec 199716 Nov 1999Beologic A/SInteractive configuration via networkUS59959634 Mar 199730 Nov 1999Fujitsu LimitedApparatus and method of multi-string matching based on sparse state transition listUS59999376 Jun 19977 Dec 1999Madison Information Technologies, Inc.System and method for converting data between data setsUS600242715 Sep 199714 Dec 1999Sitka Spruce Security LlcSecurity system with proximity sensing for an electronic deviceUS614168623 Jun 199831 Oct 2000Deterministic Networks, Inc.Client-side application-classifier gathering network-traffic statistics and application and user names using extensible-service provider plugin for policy-based network controlUS61991819 Sep 19986 Mar 2001Perfecto Technologies Ltd.Method and system for maintaining restricted operating environments for application programs or operating systemsUS62197869 Sep 199817 Apr 2001Surfcontrol, Inc.Method and system for monitoring and controlling network accessUS632084830 Apr 199920 Nov 2001Hewlett-Packard CompanyMethods of altering dynamic decision treesUS63213389 Nov 199820 Nov 2001Sri InternationalNetwork surveillanceUS632465630 Jun 199827 Nov 2001Cisco Technology, Inc.System and method for rules-driven multi-phase network vulnerability assessmentUS633412112 Mar 199925 Dec 2001Virginia Commonwealth UniversityUsage pattern based user authenticatorUS634336221 Jan 199929 Jan 2002Networks Associates, Inc.System and method providing custom attack simulation language for testing networksUS639347431 Dec 199821 May 20023Com CorporationDynamic policy management apparatus and method using active network devicesUS641532129 Dec 19982 Jul 2002Cisco Technology, Inc.Domain mapping method and systemUS647764823 Mar 19975 Nov 2002Novell, Inc.Trusted workstation in a networked client/server computing systemUS648766615 Jan 199926 Nov 2002Cisco Technology, Inc.Intrusion detection signature analysis using regular expressions and logical operatorsUS649910729 Dec 199824 Dec 2002Cisco Technology, Inc.Method and system for adaptive network security using intelligent packet analysisUS653938121 Apr 199925 Mar 2003Novell, Inc.System and method for synchronizing database informationUS658787624 Aug 19991 Jul 2003Hewlett-Packard Development CompanyGrouping targets of management policiesUS65908859 Jul 19998 Jul 2003Malibu Networks, Inc.IP-flow characterization in a wireless point to multi-point (PTMP) transmission systemUS667873413 Nov 199913 Jan 2004Ssh Communications Security Ltd.Method for intercepting network packets in a computing deviceUS66788242 Nov 199913 Jan 2004Agere Systems Inc.Application usage time limiterUS668433210 Jun 199827 Jan 2004International Business Machines CorporationMethod and system for the exchange of digitally signed objects over an insecure networkUS671112731 Jul 199823 Mar 2004General Dynamics Government Systems CorporationSystem for intrusion detection and vulnerability analysis in a telecommunications signaling networkUS675482631 Mar 199922 Jun 2004International Business Machines CorporationData processing system and method including a network access connector for limiting access to the networkUS676632024 Aug 200020 Jul 2004Microsoft CorporationSearch engine with natural language-based robust parsing for user query and relevance feedback learningUS677219627 Jul 20003 Aug 2004Propel Software Corp.Electronic mail filtering system and methodsUS678920215 Oct 19997 Sep 2004Networks Associates Technology, Inc.Method and apparatus for providing a policy-driven intrusion detection systemUS685106124 Aug 20001 Feb 2005Networks Associates, Inc.System and method for intrusion detection data collection using a network protocol stack multiplexorUS695734810 Jan 200118 Oct 2005Ncircle Network Security, Inc.Interoperability of vulnerability and intrusion detection systemsUS698332312 Aug 20023 Jan 2006Tippingpoint Technologies, Inc.Multi-level packet screening with dynamically selected filtering criteriaUS69999984 Oct 200114 Feb 2006Hewlett-Packard Development Company, L.P.Shared memory coupling of network infrastructure devicesUS703211430 Aug 200018 Apr 2006Symantec CorporationSystem and method for using signatures to detect computer intrusionsUS705882117 Jan 20026 Jun 2006Ipolicy Networks, Inc.System and method for detection of intrusion attacks on packets transmitted on a networkUS706565730 Aug 200020 Jun 2006Symantec CorporationExtensible intrusion detection systemUS707319825 Aug 20004 Jul 2006Ncircle Network Security, Inc.Method and system for detecting a vulnerability in a networkUS707680328 Jan 200211 Jul 2006International Business Machines CorporationIntegrated intrusion detection servicesUS709650329 Jun 200122 Aug 2006Mcafee, Inc.Network-based risk-assessment tool for remotely detecting local computer vulnerabilitiesUS711378924 Sep 200126 Sep 2006Bellsouth Intellectual Property CorporationMethod and system for tracking facilities related informationUS713391628 Jul 20037 Nov 2006Etelemetry, Inc.Asset tracker for identifying user of current internet protocol addresses within an organization's communications networkUS713414112 Jun 20017 Nov 2006Hewlett-Packard Development Company, L.P.System and method for host and network based intrusion detection and responseUS715210515 Jan 200219 Dec 2006Mcafee, Inc.System and method for network vulnerability detection and reportingUS71817696 Jun 200320 Feb 2007Ncircle Network Security, Inc.Network security system having a device profiler communicatively coupled to a traffic monitorUS725763010 Mar 200314 Aug 2007Mcafee, Inc.System and method for network vulnerability detection and reportingUS73057088 Mar 20044 Dec 2007Sourcefire, Inc.Methods and systems for intrusion detectionUS731068829 Aug 200018 Dec 2007Ciena CorporationRelative addressing for network elementsUS731369523 Mar 200425 Dec 2007Sourcefire, Inc.Systems and methods for dynamic threat assessmentUS731580114 Jan 20001 Jan 2008Secure Computing CorporationNetwork security modeling system and methodUS731769312 May 20048 Jan 2008Sourcefire, Inc.Systems and methods for determining the network topology of a networkUS735007717 Apr 200325 Mar 2008Cisco Technology, Inc.802.11 using a compressed reassociation exchange to facilitate fast handoffUS73636563 Nov 200322 Apr 2008Mazu Networks, Inc.Event detection/anomaly correlation heuristicsUS764427515 Apr 20035 Jan 2010Microsoft CorporationPass-thru for client authenticationUS2001002748529 Mar 20014 Oct 2001Ddi CorporationMethod for collecting statistical traffic dataUS2001003484727 Mar 200125 Oct 2001Network Security Systems, Inc.Internet/network security method and system for checking security of a client from a remote facilityUS2002003563916 Aug 200121 Mar 2002Spontaneous Networks, Inc.Systems and methods for a packet directorUS2002006603421 Sep 200130 May 2002Schlossberg Barry J.Distributed network security deception systemUS2002008334427 Jun 200127 Jun 2002Sooriya Networks, Inc.Integrated intelligent inter/intra networking deviceUS200200877164 Dec 20004 Jul 2002Mustafa ShakeelSystem and method for transmitting customized multi priority services on a single or multiple links over data link layer framesUS2002011218526 Feb 200115 Aug 2002Oracle International CorporationIntrusion threat detectionUS2002012399511 Jan 20025 Sep 2002Shibuya TetsuoPattern search method, pattern search apparatus and computer program therefor, and storage medium thereofUS2002016570726 Feb 20017 Nov 2002Call Charles G.Methods and apparatus for storing and processing natural language text data as a sequence of fixed length integersUS2003001466213 Jun 200216 Jan 2003Mcafee, Inc.Protocol-parsing state machine and method of using sameUS200300463884 Sep 20026 Mar 2003Raytheon Bbn Technologies Corp.Systems and methods for network performance measurement using packet signature collectionUS2003006581728 Sep 20013 Apr 2003Qualcomm IncorporatedExtended internet protocol network address translation systemUS2003008384731 Oct 20011 May 2003Anderson Craig D.User interface for presenting data for an intrusion protection systemUS2003009351731 Oct 200115 May 2003Tarquini Richard P.System and method for uniform resource locator filteringUS2003010135331 Oct 200129 May 2003Hewlett-Packard Development Company L.P.Method, computer-readable medium, and node for detecting exploits based on an inbound signature of the exploit and an outbound signature in response theretoUS200301402507 Mar 200224 Jul 2003Kabushikigaisha TeamgiaMethod and system of monitoring vulnerabilitiesUS200301958747 Mar 200316 Oct 2003Fujitsu LimitedSearch apparatus and method using order pattern including repeating patternUS2003021291028 Mar 200313 Nov 2003Cisco Technology, Inc.Method and system for reducing the false alarm rate of network intrusion detection systemsUS2003022972618 Mar 200311 Dec 2003Wyse Technology Inc.Default device configuration system and method for thin devicesUS2004001068410 Jun 199815 Jan 2004Ibm CorporationMethod and system for the exchange of digitally signed objects over an insecure networkUS2004001572810 Mar 200322 Jan 2004Cole David M.System and method for network vulnerability detection and reportingUS2004003477319 Aug 200219 Feb 2004Balabine Igor V.Establishing authenticated network connectionsUS2004006472630 Sep 20021 Apr 2004Hewlett-Packard Development Company, L.P.Vulnerability management and tracking system (VMTS)US2004007380022 May 200315 Apr 2004Trustwave Holdings, Inc.Adaptive intrusion detection systemUS2004009358231 Oct 200313 May 2004Segura Tim E.Method for allowing a computer to be used as an information kiosk while lockedUS2004009861814 Aug 200320 May 2004Pendragon Electronics And Telecommunications Research LlcSystem and method for defending against distributed denial-of-service attack on active networkUS2004012315311 Apr 200324 Jun 2004Apple Inc.Administration of protection of data accessible by a mobile deviceUS200401722343 Oct 20032 Sep 2004Dapp Michael C.Hardware accelerator personality compilerUS2004017947715 Mar 200416 Sep 2004Eker Steven MarkMethod and apparatus for processing network packetsUS2004019394312 Feb 200430 Sep 2004Angelino RobertMultiparameter network fault detection system using probabilistic and aggregation analysisUS2004021075615 Apr 200321 Oct 2004Microsoft CorporationPass-thru for client authenticationUS2004021853229 Apr 20034 Nov 2004Narus, Inc.Method and system for transport protocol reconstruction and timer synchronization for non-intrusive capturing and analysis of packets on a high-speed distributed networkNon-Patent CitationsReference1"Snort(TM) Users Manual 2.6.0," The Snort Project (May 23, 2006), pp. 1-126.2"TaoSecurity-Dedicated to FreeBSD, network security monitoring, incident response, and network forensics," (Oct. 1, 2007), obtained from: http://taosecurity.blogspot.com/2005/02/shmoocon-concludes-shmoocon-finished.html.3"toupper()-convert lowercase character to uppercase," http://www.mkssoftware.com, printed on Sep. 20, 2008 from http://web.archive.org, archive date Jun. 30, 2006, 2 pp.4"Snort� Users Manual 2.6.0," The Snort Project (May 23, 2006), pp. 1-126.5"TaoSecurity�Dedicated to FreeBSD, network security monitoring, incident response, and network forensics," (Oct. 1, 2007), obtained from: http://taosecurity.blogspot.com/2005/02/shmoocon-concludes-shmoocon-finished.html.6"toupper()�convert lowercase character to uppercase," http://www.mkssoftware.com, printed on Sep. 20, 2008 from http://web.archive.org, archive date Jun. 30, 2006, 2 pp.7Advisory Action issued by the U.S. Patent Office on Feb. 24, 2010 in connection with related U.S. Appl. No. 11/272,035.8Advisory Action issued by the U.S. Patent Office on Sep. 29, 2009 in connection with related U.S. Appl. No. 10/843,459.9Aho et al., "Efficient String Matching: An Aid to Bibliographic Search," Communications from the ACM (Jun. 1975), vol. 18, No. 6, pp. 333-340.10B. Krishnamurthy, "Web Protocols and Practice," (May 1, 2001), pp. 518-520.11D. Joseph, et al., "A Policy-aware Switching Layer for Data Centers," SIGCOMM, Aug. 17-22, 2008, pp. 51-62.12D. Roelker, "HTTP IDS Evasions Revisited" (Aug. 1, 2003) [online] (retrieved on Nov. 9, 2006). Retrieved from the Internet .13D. Roelker, "HTTP IDS Evasions Revisited" (Aug. 1, 2003) [online] (retrieved on Nov. 9, 2006). Retrieved from the Internet <URL: http://docs.idsresearch.org/http�ids�evasions.pdf>.14European Office Action issued by the European Patent Office on Nov. 28, 2008 in connection with European patent application No. 07 015 003.2-2413, which corresponds to related U.S. Appl. No. 11/501,776.15European Search Report issued by the European Patent Office on Dec. 27, 2007 in connection with European patent application No. 07015003.2-2413, which corresponds to related U.S. Appl. No. 11/501,776.16European Search Report issued by the European Patent Office on Nov. 22, 2007 in connection with European patent application No. 07014575.0-1244, which corresponds to related U.S. Appl. No. 11/493,934.17European Search Report issued by the European Patent Office on Nov. 22, 2007 in connection with European patent application No. 07014575.0�1244, which corresponds to related U.S. Appl. No. 11/493,934.18European Search Report issued by the European Patent Office on Oct. 12, 2009 in connection with European patent application No. 05773501.1 -2201, which corresponds to related U.S. Appl. Nos. 10/898,220, 11/785,609 and 12/010,900.19Final Office Action issued by the U.S. Patent Office on Aug. 19, 2008 in connection with related U.S. Appl. No. 10/843,373.20Final Office Action issued by the U.S. Patent Office on Aug. 20, 2008 in connection with related U.S. Appl. No. 10/843,353.21Final Office Action issued by the U.S. Patent Office on Aug. 6, 2008 in connection with related U.S. Appl. No. 10/843,375.22Final Office Action issued by the U.S. Patent Office on Dec. 8, 2009 in connection with related U.S. Appl. No. 11/272,034.23Final Office Action issued by the U.S. Patent Office on Dec. 9, 2009 in connection with related U.S. Appl. No. 11/272,035.24Final Office Action issued by the U.S. Patent Office on Jul. 17, 2008 in connection with related U.S. Appl. No. 10/843,459.25Final Office Action issued by the U.S. Patent Office on Jun. 26, 2008 in connection with related U.S. Appl. No. 10/898,220.26Final Office Action issued by the U.S. Patent Office on Mar. 17, 2010 in connection with related U.S. Appl. No. 10/843,374.27Final Office Action issued by the U.S. Patent Office on May 13, 2009 in connection with related U.S. Appl. No. 10/843,374.28Final Office Action issued by the U.S. Patent Office on May 9, 2008 in connection with related U.S. Appl. No. 10/843,353.29Final Office Action issued by the U.S. Patent Office on Oct. 29, 2009 in connection with related U.S. Appl. No. 11/501,776.30Full Band and Matrix Algorithms (Jun. 9, 2004), http://web.archive.org/web20040109154658/http://www.netlib.org/utk/Isi/pcwLSI/text/node150.html.31International Preliminary Report on Patentability and Written Opinion of the International Searching Authority mailed on Mar. 17, 2009 in connection with corresponding PCT application No. PCT/US06/43820, which corresponds to related U.S. Appl. No. 11/272,035.32International Preliminary Report on Patentability and Written Opinion of the International Searching Authority mailed on Mar. 3, 2009 in connection with PCT application No. PCT/US05/025584, which corresponds to related U.S. Appl. No. 10/898,220.33International Preliminary Report on Patentability mailed on Apr. 7, 2009 in connection with PCT application No. PCT/US07/021351, which corresponds to U.S. Appl. No. 11/905,980.34International Preliminary Report on Patentability mailed on May 22, 2008 in connection with PCT application No. PCT/US06/43800, which corresponds to U.S. Appl. No. 11/272,034.35International Preliminary Report on Patentability mailed on Nov. 12, 2009 in connection with PCT application No. PCT/US08/005466, which corresponds to U.S. Appl. No. 12/149,196.36International Preliminary Report on Patentability mailed on Sep. 11, 2009 in connection with PCT application No. PCT/US08/002454, which corresponds to U.S. Appl. No. 11/711,876.37International Search Report and Written Opinion of the International Searching Authority issued on Aug. 18, 2008 in connection with PCT application No. PCT/US08/05466, which corresponds to U.S. Appl. No. 12/149,196.38International Search Report and Written Opinion of the International Searching Authority issued on Dec. 5, 2007 in connection with PCT application No. PCT/US05/25583, which corresponds to U.S. Appl. No. 10/951,796.39International Search Report and Written Opinion of the International Searching Authority issued on Jul. 2, 2008 in connection with PCT application No. PCT/US08/02454, which corresponds to U.S. Appl. No. 11/711,876.40International Search Report and Written Opinion of the International Searching Authority issued on Jul. 7, 2008 in connection with PCT application No. PCT/US06/43820, which corresponds to U.S. Appl. No. 11/272,035.41International Search Report and Written Opinion of the International Searching Authority issued on Jun. 19, 2008 in connection with PCT application No. PCT/US05/25584, which corresponds to U.S. Appl. No. 10/898,220.42International Search Report and Written Opinion of the International Searching Authority issued on Jun. 30, 2008 in connection with PCT application No. PCT/US07/21351, which corresponds to U.S. Appl. No. 11/905,980.43International Search Report and Written Opinion of the International Searching Authority issued on Mar. 16, 2010 in connection with PCT application No. PCT/US09/59965, which corresponds to U.S. Appl. No. 12/575,612.44International Search Report and Written Opinion of the International Searching Authority issued on Oct. 9, 2007 in connection with PCT application No. PCT/US06/43800, which corresponds to U.S. Appl. No. 11/272,034.45International Search Report and Written Opinion of the International Searching Authority mailed on May 27, 2009 in connection with PCT application No. PCT/US09/02210, which corresponds to U.S. Appl. No. 12/230,338.46J. Novak et al., "Target-Based TCP Stream Reassembly" (Aug. 3, 2007), Revision 1.0, pp. 1-23, obtained from: http://www.snort/org/docs/stream5-mode1AUg032007.pdf.47J. Novak, "Target-Based Fragmentation Reassembly" (Apr. 2005), Revision 2.0, pp. 1-32.48Lyon, Gordon; Remote OS detection via TCP/IP Stack Fingerprinting, Jun. 30, 2002; pp. 1-12; obtained from: http://web.archive.org/web/20021017063625/www.insecure.org/nmap/nmap-fingerprinting-article.html.49M. Norton, "Optimizing Pattern Matching for Intrusion Detection" (Jul. 4, 2004) [online] (retrieved on Nov. 9, 2006). Retrieved from the Internet .50M. Norton, "Optimizing Pattern Matching for Intrusion Detection" (Jul. 4, 2004) [online] (retrieved on Nov. 9, 2006). Retrieved from the Internet <URL: http://docs.idsresearch.org/OptimizingPatternMatchingForIDS.pdf>.51N. Brownlee, et al., "Methodology for Passive Analysis of a University Internet Link," PAM2001 Passive and Active Measurement Workshop, Apr. 2001 (7 pp.).52N. Chase, "Active Server Pages 3.0 from Scratch" (Dec. 1999), Searching for products section, 13 pp.53Norton et al., "Multi-Patten Search Engine Aho-Corasick State Machine" (Mar. 17, 2004), Version 2.0, 36 pp.54Norton et al., "Sourcefire Optimizing Pattern Matching for Intrusion Detection" (Sep. 2004), 14 pp.55Notice of Allowance issued by the U.S. Patent Office on Aug. 18, 2008 in connection with related U.S. Appl. No. 11/272,033.56Notice of Allowance issued by the U.S. Patent Office on Dec. 8, 2009 in connection with related U.S. Appl. No. 11/501,776.57Notice of Allowance issued by the U.S. Patent Office on Feb. 5, 2010 in connection with related U.S. Appl. No. 11/272,034.58Notice of Allowance issued by the U.S. Patent Office on Jan. 21, 2009 in connection with related U.S. Appl. No. 10/898,220.59Notice of Allowance issued by the U.S. Patent Office on Jan. 7, 2010 in connection with related U.S. Appl. No. 10/843,353.60Notice of Allowance issued by the U.S. Patent Office on Jan. 8, 2010 in connection with related U.S. Appl. No. 10/843,373.61Notice of Allowance issued by the U.S. Patent Office on Jun. 11, 2009 in connection with related U.S. Appl. No. 10/843,373.62Notice of Allowance issued by the U.S. Patent Office on Mar. 5, 2010 in connection with related U.S. Appl. No. 11/785,609.63Notice of Allowance issued by the U.S. Patent Office on Oct. 15, 2008 in connection with related U.S. Appl No. 10/951,796.64Notice of Allowance issued by the U.S. Patent Office on Oct. 21, 2008 in connection with related U.S. Appl. No. 10/843,375.65Notice of Allowance issued by the U.S. Patent Office on Oct. 5, 2007 in connection with related U.S. Appl. No. 10/793,887.66Notice of Allowance issued by the U.S. Patent Office on Sep. 6, 2007 in connection with related U.S. Appl. No. 10/843,376.67Office Action issued by the European Patent Office on Jan. 15, 2010 in connection with European patent application No. 05773501.1-2201, which corresponds to related U.S. Appl. Nos. 10/898,220, 11/785,609 and 12/010,900.68Office Action issued by the U.S. Patent and Trademark Office on Jan. 10, 2008 in connection with U.S. Appl. No. 10/843,373.69Office Action issued by the U.S. Patent Office on Apr. 15, 2010 in connection with related U.S. Appl. No. 12/010,900.70Office Action issued by the U.S. Patent Office on Apr. 21, 2010 in connection with related U.S. Appl. No. 10/843,459.71Office Action issued by the U.S. Patent Office on Apr. 28, 2009 in connection with related U.S. Appl. No. 11/501,776.72Office Action issued by the U.S. Patent Office on Apr. 7, 2010 in connection with related U.S. Appl. No. 11/711,876.73Office Action issued by the U.S. Patent Office on Aug. 20, 2009 in connection with related U.S. Appl. No. 10/843,374.74Office Action issued by the U.S. Patent Office on Dec. 17, 2009 in connection with related U.S. Appl. No. 11/493,934.75Office Action issued by the U.S. Patent Office on Dec. 23, 2008 in connection with related U.S. Appl. No. 11/272,034.76Office Action issued by the U.S. Patent Office on Feb. 4, 2009 in connection with related U.S. Appl. No. 10/843,373.77Office Action issued by the U.S. Patent Office on Feb. 9, 2009 in connection with related U.S. Appl. No. 10/843,459.78Office Action issued by the U.S. Patent Office on Jan. 16, 2009 in connection with related U.S. Appl. No. 10/843,353.79Office Action issued by the U.S. Patent Office on Jan. 21, 2009 in connection with related U.S. Appl. No. 11/493,934.80Office Action issued by the U.S. Patent Office on Jul. 11, 2008 in connection with related U.S. Appl. No. 11/272,034.81Office Action issued by the U.S. Patent Office on Jul. 16, 2007 in connection with related U.S. Appl. No. 10/898,220.82Office Action issued by the U.S. Patent Office on Jul. 28, 2009 in connection with related U.S. Appl. No. 10/843,353.83Office Action issued by the U.S. Patent Office on Jul. 30, 2009 in connection with related U.S. Appl. No. 11/493,934.84Office Action issued by the U.S. Patent Office on Jul. 6, 2009 in connection with related U.S. Appl. No. 10/843,459.85Office Action issued by the U.S. Patent Office on Jun. 1, 2009 in connection with related U.S. Appl. No. 11/272,035.86Office Action issued by the U.S. Patent Office on Jun. 23, 2009 in connection with related U.S. Appl. No. 11/785,609.87Office Action issued by the U.S. Patent Office on Mar. 16, 2010 in connection with related U.S. Appl. No. 11/272,035.88Office Action issued by the U.S. Patent Office on Mar. 20, 2008 in connection with related U.S. Appl. No. 10/843,374.89Office Action issued by the U.S. Patent Office on Mar. 22, 2010 in connection with related U.S. Appl. No. 11/493,934.90Office Action issued by the U.S. Patent Office on May 14, 2009 in connection with related U.S. Appl. No. 11/272,034.91Office Action issued by the U.S. Patent Office on Oct. 4, 2007 in connection with related U.S. Appl. No. 10/951,796.92Office Action issued by the U.S. Patent Office on Oct. 6, 2008 in connection with related U.S. Appl. No. 10/843,374.93Office Action issued by the U.S. Patent Office on Sep. 26, 2007 in connection with related U.S. Appl. No. 10/843,353.94Office Action issued by the U.S. Patent Office on Sep. 6, 2007 in connection with related U.S. Appl. No. 10/843,374.95Office Action issued on Feb. 21, 2008 in connection with the related U.S. Appl. No. 11/272,033.96Office Action issued on Feb. 5, 2008 in connection with the related U.S. Appl. No. 10/843,375.97Office Action issued on Mar. 12, 2008 in connection with the related U.S. Appl. No. 10/843,459.98R. Deraison, et al., "Nessus Network Auditing," Sungress Publishing, Jul. 20, 2004, pp. 1-13.99R. Deraison, et al., "Passive Vulnerability Scanning: Introduction to NeVO," Tenable Network Security, May 30, 2004, pp. 1-13.100R. Gula, "Passive Vulnerability Detection. Techniques to passively find network security vulnerabilities," Sep. 9, 1999 (5 pp.).101R.P. Lippmann et al., "Passive Operating System Identification from TCP/IP Packet Headers," Proceedings Workshop on Data Mining for Computer Security(DMSEC), Nov. 2003 (10 pp.).102S.Siddharth, "Evading NIDS, revisited" (Dec. 12, 2005).103Spitzner, Lance; Passive Fingerprinting, May 3, 2003; FOCUS on Intrusion Detection; pp. 1-4; obtained from http://www.ctillhq.com/pdfdb/000183/data.pdf.104T. Ptacek, et al., "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection", Jan. 1998, pp. 1-63.105Tarjan, et al., "Storing a Sparse Table," Communications of the ACM (Nov. 1979), vol. 2, No. 11, pp. 606-620.106U. Shankar and V. Paxson, Active Mapping: Resisting NIDS Evasion Without Altering Traffic, Proc. IEEE Symposium on Security and Privacy. May 2003, pp. 1-18.107U.S. Appl. No. 10/843,353, filed May 2004, Roesch et al., System and Method for Determining Characteristics of a Network and Analyzing Vulnerabilities.108U.S. Appl. No. 10/843,373, filed May 2004, Roesch et al., Systems and Methods for Identifying the Services of a Network.109U.S. Appl. No. 10/843,374, filed May 2004, Roesch et al., System and Methods for Determining Characteristics of a Network Based on Flow Analysis.110U.S. Appl. No. 10/843,375, filed May 2004, Roesch et al., Systems and Methods for Determining Characteristics of a Network and Assessing Confidence.111U.S. Appl. No. 10/843,459, filed May 2004, Roesch et al., Systems and Methods for Determining Characteristics of a Network and Enforcing Policy.112U.S. Appl. No. 10/898,220, filed Jul. 2004, Norton et al., Methods and Systems for Multi-Pattern Searching.113U.S. Appl. No. 10/951,796, filed Sep. 2004, Roelker et al., Intrusion Detection Strategies for Hypertext Transport Protocol.114U.S. Appl. No. 11/272,033, filed Nov. 2005, Dempster et al., Systems and Methods for Identifying the Client Applications of a Network.115U.S. Appl. No. 11/272,034, filed Nov. 2005, Vogel, III et al., Systems and Methods for Modifying Network Map Attributes.116U.S. Appl. No. 11/272,035, filed Nov. 2005, Gustafson et al., Intrusion Event Correlation with Network Discovery Information.117U.S. Appl. No. 11/493,934, filed Jul. 2006, Roesch et al., Device, System and Method for Analysis of Fragments in a Fragment Train.118U.S. Appl. No. 11/501,776, filed Aug. 2006, Roesch et al., Device, System and Method for Analysis of Segments in a Transmission Control Protocol (TCP) Session.119U.S. Appl. No. 11/711,876, filed Feb. 2007, Sturges et al., Device, System and Method for Timestamp Analysis of Segments in a Transmission Control.120U.S. Appl. No. 11/785,609, filed Apr. 2007, Norton et al., Methods and Systems for Multi-Pattern Searching.121U.S. Appl. No. 11/905,980, filed Oct. 2007, Roesch, Device, System and Method for Use of Micro-Policies in Intrusion Detection/Prevention.122U.S. Appl. No. 12/010,900, filed Jan. 2008, Norton et al., Methods and Systems for Multi-Pattern Searching.123U.S. Appl. No. 12/149,196, filed Apr. 2008, Rittermann, Real-Time User Awareness for a Computer Network.124U.S. Appl. No. 12/230,338, filed Aug. 2008, Sturges et al., Speed and Memory Optimization of Intrusion Detection System (IDS) and Intrusion Prevention.125U.S. Appl. No. 12/813,859, filed Jun. 2010, Polley et al.126V. Jacobson, et al., Request for Comments: 1323, "TCP Extensions for High Performance," May 1992 (35 pages).Referenced byCiting PatentFiling datePublication dateApplicantTitleUS82720558 Oct 200918 Sep 2012Sourcefire, Inc.Target-based SMB and DCE/RPC processing for an intrusion detection system or intrusion prevention systemUS828988215 Jan 201016 Oct 2012Sourcefire, Inc.Systems and methods for modifying network map attributesUS2011031414322 Jun 201022 Dec 2011Sourcefire, Inc.System and method for resolving operating system or service identity conflictsRotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services©2012 Google