Patent ID: 8510791

Claim:
A method for dynamic protocol decoding, comprising: employing at least one hardware processor for: (a) providing a protocol decoding program adapted to analyze data received from a network in an intrusion detection system, the protocol decoding program comprising concrete type instructions of at least two types and pseudo type instructions of at least two types, each concrete type instruction implying a different value specifying a number of bytes and causing reading of a data unit of a data packet, a length of said data unit being the number of bytes defined by the respective concrete type instruction, each concrete type instruction being followed by one or more pseudo type instructions, including a pseudo type instruction of a type for operating on data contained in data units already read by concrete type instructions, the pseudo type instructions further comprising at least one pseudo type instruction of a type for controlling a program flow of the protocol decoding program; (b) analyzing the data packet, comprising executing the protocol decoding program including: (i) executing the concrete type instruction, the concrete type instruction causing a next data unit in the data packet to be read in sequence, the length of the next data unit being specified by the concrete type instruction being executed; the number of bytes to be read being dynamically defined by the concrete type instruction being executed as a parameter of said concrete type instruction, a value of the parameter being fixed; (ii) executing the pseudo type instruction following the execution of the concrete type instruction; (iii) provided a predefined condition regarding the data unit read in the step (i) is met, triggering a rule of the protocol decoding program, comprising triggering the rule by at least one of a data pattern, a signalled event, or a counter; and (iv) repeating the steps (i)-(iii) until the data packet is decoded or the analyzing step is terminated by the rule triggered in the step (iii).