Abstract:
A network traffic scanner and firewall system inspects packets for malicious contents. The system uses a stateful stack inspection method to scan network traffic at multiple levels in varying manners appropriate to the content of the traffic. The system analyzes data streams, data packages, and package contents, as well as decoding and decrypting data when applicable, to determine whether the data are malicious.

Description:
BACKGROUND OF INVENTION  
       [0001]     1. Field of the Invention  
         [0002]     The present invention generally relates to an antivirus system. More specifically, the present invention relates to an antivirus system which scans incoming data packets for viruses and their signatures.  
         [0003]     2. Description of the Prior Art  
         [0004]     With the proliferation of networked computer systems, criminals and vandals have gone high-tech to ply their trade. Computer systems, particularly those on networks, are routinely infiltrated by malicious software programs, sometimes called “malware”, such as viruses, Trojan horse programs, worms, backdoors, zombieware, adware, spyware, keystroke loggers, disk scanners, and so forth, whose purposes range from simple mayhem to information theft to network disruption. These programs arrive via many different routes: the user may download a program believing it to be a useful application, only to discover, too late, that it is a malicious program; an electronic mail attachment appearing to be from a friend might have been sent by a hacker or a hacker&#39;s tools; a flaw in the computer&#39;s operating system or network-enabled application can leave an exploitable “hole” open for a knowledgeable attacker to break in through. Naturally, a counter-effort has developed to provide tools to detect, block, neutralize, and/or remove such software, to protect the security and integrity of people&#39;s computers and personal data.  
         [0005]     Early antivirus software was developed to scan files for virus signatures, such as code fragments that match known viruses. This type of protection is geared to detection after the system has already been compromised. While it works well in this regard, antivirus software is inherently designed to work on entire files and does not provide real-time monitoring of network traffic to protect the modern networked computer against attacks. Moreover, antivirus software inherently provides no protection against network attacks designed to penetrate flaws in the operating system, said flaws which on a networked computer allow hackers to install malicious software or issue commands remotely.  
         [0006]     To protect against network intrusion in real time, software firewalls were subsequently developed. Application proxy firewalls, which include content inspection technology, are well known in the art. These software packages scan downloaded files and email attachments as they arrive for “signatures” and code segments of known malicious software. Files are completely downloaded into a quarantined area, scanned for virus signatures, are optionally cleaned of viruses, and may then be either blocked or passed on to the application programs. This has several disadvantages, including slowed performance, download size limits, and the need to keep empty disk space set aside for the firewall software&#39;s quarantined area.  
         [0007]     Some software firewalls are capable of stateful packet inspection (SPI). This allows inspection of the packet header. Other software firewalls are capable of deep packet inspection. This allows inspection of the contents of packets to look for virus signatures, but it is limited in that the method does not delve into the structure of packet contents. A worm using a compressed file would be able to pass through, since the traditional firewall technology does not extend to decompressing the packet data and inspecting the decompressed contents.  
         [0008]     Hardware firewalls have similar issues and more limitations. These are externally-attachable devices which provide the same features as software firewalls, but offload the computational load to a separate device. They have limited internal storage and thus provide the same disadvantages as software firewalls regarding download size limits and slowed performance. Unlike a software firewall, increasing available storage for a hardware firewall involves buying new hardware, if it is possible at all.  
         [0009]     Because of these limitations and performance problems of the prior art, it is desirable to develop a better firewall.  
       SUMMARY OF INVENTION  
       [0010]     It is therefore an objective of the present invention to reduce performance bottlenecks by scanning network traffic in a near-real-time manner.  
         [0011]     It is a further objective of the present invention to eliminate file size limitations on incoming traffic by performing the actions of a firewall without the use of the application proxy.  
         [0012]     The claimed invention provides a method for a computer firewall system comprising the following steps: creating a state machine for managing a plurality of sub-state machines; receiving a plurality of network packets; creating the plurality of states for each sub-state machine on tracking data analysis of the network packets; performing data analysis on the network packets; and passing a subset of the network packets according to results of data analysis.  
         [0013]     These and other objectives of the present invention will no doubt become obvious to those of ordinary skill in the art after reading the following detailed description of the preferred embodiment that is illustrated in the various figures and drawings. 
     
    
     BRIEF DESCRIPTION OF DRAWINGS  
       [0014]      FIG. 1  is a block diagram showing a high-level overview of a method for providing a firewall according to the present invention.  
         [0015]      FIG. 2  is a flowchart showing a state engine of the method for providing a firewall according to the present invention.  
         [0016]      FIG. 3  is a block diagram showing an overview of the present invention firewall method compared against the prior-art firewall and antivirus methods, and against the prior-art OSI model.  
         [0017]      FIG. 4  is a block diagram showing a high-level overview of a firewall according to the present invention.  
         [0018]      FIG. 5  is a flowchart showing a package method of the firewall according to the present invention.  
         [0019]      FIG. 6  is a flowchart showing a decode method of the firewall according to the present invention.  
         [0020]      FIG. 7  is a flowchart showing a data method of the firewall according to the present invention.  
         [0021]      FIG. 8  is a flowchart showing a decrypt method of the firewall method according to the present invention. 
     
    
     DETAILED DESCRIPTION  
       [0022]     Please refer to  FIG. 1 , which is a block diagram showing a high-level overview of a method for providing a firewall according to the present invention. The method comprises content/application inspection of network traffic through a number of units. The network traffic is transmitted through the physical layer  100 , similar to the physical layer of the seven-layer OSI (Open System Interconnect) basic reference model of networking, as defined by the International Organization for Standardization (ISO) and incorporated herein by reference. Inside a protocol unit  110 , multiple layers of inspection take place, including a session unit  111 , a package unit  112 , a decode (or decoder) unit  113 , a decrypt (or decryption) unit  114 , an other unit  115 , and a data unit  116 . Each layer (or unit) can inspect data and pass it along via preserving the sub-state by itself, or can refer it deeper into the next layer for further processing.  
         [0023]     Please refer to  FIG. 4 , which is a block diagram showing a high-level overview of a firewall according to the present invention. The present invention comprises an input unit  400  and an output unit  440 . Between the input and output units  400 ,  440 , data is collected and scanned as it arrives. A scan engine comprises a stateful stack inspection engine unit  410  to extract the plain data from packets and manage a search within incoming data; a content match unit  420  to do the actual matching of virus signatures with the data, no matter whether the matching method is based on software or hardware; and a response unit  430  to perform any actions necessary on the data, such as removing viruses or stopping incoming streams. At the input unit  400 , data are collected from a network and controlled to be in sequential order before being sent into the stateful stack inspection engine unit  410 .  
         [0024]     Please refer to  FIG. 2 , which is a flowchart showing operations performed by the stateful stack inspection engine unit  410  of  FIG. 4 . The process includes the following steps:  
         [0025]     Step  200 : Start;  
         [0026]     Step  210 : Test whether this is a new stateful stack inspection. When not a new stateful stack inspection, proceed to step  230 , otherwise proceed to step  220 ;  
         [0027]     Step  220 : Create a new state and set the state level to zero (i.e. the top level);  
         [0028]     Step  230 : Determine at which level the current state processing is;  
         [0029]     Step  240 : Perform processing for the current state;  
         [0030]     Step  250 : Determine whether the state level needs to be increased to process a new level of information; when it does not, proceed to step  270 , otherwise proceed to step  260 ;  
         [0031]     Step  260 : Increase the state level by one, and return to step  230 ;  
         [0032]     Step  270 : Determine whether the state is ending; when the state is not ending, proceed to step  290 , otherwise proceed to step  280 ;  
         [0033]     Step  280 : Decrease the state level by one, and return to step  230 ;  
         [0034]     Step  290 : End.  
         [0035]     The units, namely the session unit  111 , package unit  112 , decode unit  113 , decrypt unit  114 , other unit  115 , and data unit  116  shown in  FIG. 1 , are instantiations of the sub-states, i.e., a given state is used to track the processing of the method, while the units actually carry out the processing (i.e. data analysis for virus signatures). Thus, for example, in step  240  in the above method, the package unit  112  can process one or more package states for one or more specific package-related tasks, which are termed states.  
         [0036]     In the method of  FIG. 2 , the steps shown can be performed in sequences other than that indicated, and the method can further include other intermediate steps. Specifically, the positions of the steps  260  and  280  can be exchanged.  
         [0037]     Please refer to  FIG. 3 , which is a block diagram showing an overview of the present invention firewall method compared against the prior-art firewall and antivirus methods, and against the prior-art OSI mode. The OSI model  310  has seven layers: an application layer  311 , where user programs send and receive data; a presentation layer  312 , which standardizes formats between different machine architectures; a session layer  313 , which handles connection protocols; a transport layer  314 , which manages error correction and data coordination; a network layer  315 , which handles addressing of data between hosts; and a data link layer  316  and physical layer  317  which are at the level of electrical signaling of the hardware.  
         [0038]     Continuing with  FIG. 3 , prior-art firewalls  320  deal with data at all levels. When integrated into hardware, hardware firewalls have physical layer  327  and data link layer  326  components. Both hardware and software firewalls engage in packet filtering  325  at the transport layer  314  and network layer  315  levels; they also engage in stateful packet inspection  324  at the session layer  313  level, and deep packet inspection  323  and multistack stateful inspection  322  across the presentation layer  312  level. At the application layer  311  level, prior-art firewalls  320  engage in deep content inspection  328  as well. The core of these prior-art firewalls  320  is the application proxy layer  321  in the application layer  311  level, wherein the firewalls  320  gather the full contents of a file before scanning it for viruses, Trojans, and other malware. The present invention, multistack stateful inspection  322 , is at the presentation layer  312  level. The present invention, can preserve the advantages of the SPI firewall and provide more secure functionality, and also improve the performance issue for the application proxy firewall.  
         [0039]     Again in  FIG. 3 , prior-art antivirus software  330  deals with data only at the top levels of networking. For a file  333 , desktop antivirus software  330  scans the virus directly. For deep content inspection methods  334  at the application layer  311  level, an antivirus gateway can scan the virus after proxying  331  reassembles the fully-downloaded files from the network. The present invention stateful stack inspection  332  scans the virus at the presentation layer  312  level without reassembling the fully-download files, and thus, it has improved performance issue over application proxy-file based antivirus gateways.  
         [0040]     Intrusion detection and prevention (IDP) method  340 , as shown in  FIG. 3 , does not use a application proxy. Instead, IDP  340  engages in deep packet inspection  343 , stateful packet inspection  344 , and packet filtering  345  thereby covering layers  312 ˜ 315  of the OSI model  310 . Specifically, deep packet inspection  343  can be performed at the presentation layer  312  level, stateful packet inspection  344  can be performed at the session layer  313  level, and packet filtering  345  can be performed at the transport  314  and network  315  layer levels. In an IDP, the present invention stateful stack inspection  332  can provide more accurate detection by, for instance, scanning compressed or encoded data.  
         [0041]     Please refer to  FIG. 5 , which shows a flowchart of a package method of the firewall according to the present invention. The package method can be embodied in the package unit  112  of  FIG. 1 . The net result of the operations in this method is to detect package boundaries and identify individual sections of the stream for analysis. The package method includes the following steps:  
         [0042]     Step  500 : Start;  
         [0043]     Step  510 : The method can be entered from the protocol unit  110  or the session unit  111 ;  
         [0044]     Step  520 : Is a package found? If a package has been found perform step  530 , otherwise perform step  550 ;  
         [0045]     Step  530 : Has the end of data been reached? If this is the end of data, perform step  560 , otherwise perform step  540 ;  
         [0046]     Step  540 : Perform a package state process which depends on the type of the package;  
         [0047]     Step  550 : If the next unit is a decode unit  113 , a decrypt unit  114 , a data unit  116 , or an other unit  115 , perform step  580 , otherwise perform step  590 ;  
         [0048]     Step  560 : Is this the start of the data? If this is the start of the data, perform step  570 , otherwise perform step  590 ;  
         [0049]     Step  570 : Perform an initial package process;  
         [0050]     Step  580 : Process the next unit;  
         [0051]     Step  590 : End.  
         [0052]     The package method of  FIG. 5  can be used for MIME (Multipurpose Internet Mail Extensions) and HTTP packages, as well as other well-known types of packages. The package state process of step  540  and initial package process  570  are well known in the art. The steps shown can be performed in sequences other than that indicated, and the method can further include other intermediate steps.  
         [0053]     Please refer to  FIG. 6 , which shows a flowchart of a decode method of the firewall according to the present invention. The decode method can be embodied in the decode unit  113  of  FIG. 1 . The net result of the operations in this method is to decode encoded information so that it can be properly inspected. The decode method includes the following steps:  
         [0054]     Step  600 : Start;  
         [0055]     Step  610 : The method can be entered from the protocol unit  110 , the session unit  111 , or the package unit  112 ;  
         [0056]     Step  620 : Determine if a decoder is needed. If decoding is needed perform step  630 , otherwise perform step  640 ;  
         [0057]     Step  630 : Perform a decoding process;  
         [0058]     Step  640 : If the next unit is a decrypt unit  114 , a data unit  116 , or an other unit  115 , perform step  650 , otherwise perform step  660 ;  
         [0059]     Step  650 : Process the next unit;  
         [0060]     Step  660 : End.  
         [0061]     In the decode method of  FIG. 6 , various encodings are possible, including Base64 which is frequently used in MIME, Quoted-Printable used in some electronic mail packages, UU (UNIX-to-UNIX) encoding, and other well-known schemes. Once identified, the system can continue and perform data analysis or content matching. Moreover, the steps shown can be performed in sequences other than that indicated, and the method can further include other intermediate steps.  
         [0062]     Please refer to  FIG. 7 , which is a flowchart showing a data method of the firewall according to the present invention. The data method can be embodied in the data unit  116  of  FIG. 1 . The net result of the operations in this method is to inspect data. The data method includes the following steps:  
         [0063]     Step  700 : Start;  
         [0064]     Step  710 : The method can be entered from the protocol unit  110 , the session unit  111 , the package unit  112 , the decode unit  113 , or the decrypt unit  114 ;  
         [0065]     Step  720 : Is the data format known? If the data format is known perform step  730 , otherwise perform step  740 ;  
         [0066]     Step  730 : Perform a data format process;  
         [0067]     Step  740 : Perform content matching at a content matching unit;  
         [0068]     Step  750 : End.  
         [0069]     If able to identify the data format, the method processes data with an appropriate processor such as OLE2 (Microsoft Object Linking and Embedding, second version) or decompression (step  730 ). Decompression can include such standard formats as ZIP, Gzip, and BZ2. If unable to identify the data format, the method processes content matching at a unit such as the content match unit  420  of  FIG. 4 . Such a content matching unit typically combs through data looking for viruses, Trojans, and other intrusion attempts and performs appropriate actions when such undesired items are found, comprising modifying the data, deleting the data, or terminating the session. If no undesired items are found, or if the matching unit cannot understand the data format, the firewall takes no action and allows the data to pass through unchanged. The steps shown above can be performed in sequences other than that indicated, and the method can further include other intermediate steps.  
         [0070]     Please refer to  FIG. 8 , which is a flowchart showing a decrypt method of the firewall according to the present invention. The decrypt method can be embodied in the decrypt unit  114  of  FIG. 1 . The decrypt method includes the following steps:  
         [0071]     Step  800 : Start;  
         [0072]     Step  810 : The method can be entered from the protocol unit  110 , the session unit  111 , the package unit  112 , the decode unit  113 , or the decrypt unit  114 ;  
         [0073]     Step  820 : Is the file encrypted? If the file is encrypted perform step  830 , otherwise perform step  840 ;  
         [0074]     Step  830 : Perform a decryption process;  
         [0075]     Step  840 : If the next unit is a data unit  116  or an other unit  115 , perform step  850 , otherwise perform step  860 ;  
         [0076]     Step  850 : Process the next unit;  
         [0077]     Step  860 : End.  
         [0078]     In step  820 , the method can decrypt data to inspect the content for malicious code. Cryptographic schemes that can be used include Data Encryption Standard (DES), Advanced Encryption Standard (AES), and the popular public key Rivest, Shamir, and Adleman (RSA) scheme. The steps shown above can be performed in sequences other than that indicated, and the method can further include other intermediate steps.  
         [0079]     For a summary of which units can be entered from which units, please refer to Table 1.  
                                                         TABLE 1                                       To            From   Protocol   Session   Package   Decode   Decrypt   Other   Data               Protocol       X   X   X   X   X   X       Session           X   X   X   X   X       Package           X   X   X   X   X       Decode               X   X   X   X       Decrypt                   X   X   X       Other           X   X   X   X   X       Data                           X                  
 
         [0080]     In Table 1, and “X” indicates that the unit listed at the top can be entered from the unit to the left. For example, from the package unit  112 , the decode unit  113  can be entered, while the session unit  111  cannot. Also note that some units can be entered from themselves. Also note that the term “entered” is sometimes known as “called”.  
         [0081]     Referring back to  FIG. 4 , the stateful stack inspection engine unit  410  creates new levels as necessary for inspecting a given data stream. When a new stream connects to the firewall, the stateful stack inspection engine unit  410  allocates a new state for the session unit  111 . If the stream is MIME-packaged, the stateful stack inspection engine unit  410  creates a new sub-state for handling de-packaging using the package unit  112 . As the packages are found, then when necessary, the stateful stack inspection unit  410  allocates sub-states for decoding the packages with the decode unit  113 , which may in turn request that the stateful stack inspection engine unit  410  allocate a new sub-state to manage decryption with the decrypt unit  114 . The decrypt unit may need to manage data with an other unit  115 , and will cause the stateful stack inspection engine unit  410  to create a new sub-state for this purpose. The other unit  115  may determine that the data needs to be scanned for virus signatures, and cause the stateful stack inspection engine unit  410  to create a state for a data unit  116 , which will then perform data analysis and virus signature matching.  
         [0082]     All units are directly connected to the matching unit  420 . Any unit can generate a virus match, and any unit can determine that data is safe and allow such data to pass through.  
         [0083]     Each level is triggered only as necessary to inspect incoming data, and only those levels which are actually necessary are executed. This saves resources and speeds processing. Most important, data is managed as it arrives or departs, allowing the firewall to function without use of a application proxy, thus freeing the firewall from the limitations and performance bottlenecks that prior art application proxy firewalls and antivirus products are heir to. Thus the present invention achieves its objectives and improves the state of the art.  
         [0084]     Those skilled in the art will readily observe that numerous modifications and alterations of the device and method may be made while retaining the teachings of the invention. Accordingly, the above disclosure should be construed as limited only by the metes and bounds of the appended claims.