Reduction of false positive detection of signature matches in intrusion detection systems
View Patent ↗Detection of a signature in a data packet comprises performing a pre-classification of the packet, using header information and particularly a 5-tuple access control list, into one of a multiplicity of flows and directing the payload of the packet to a respective one of a multiplicity of deterministic finite state machines each of which stores a plurality of signatures as a sequence of states and acts only on the respective flow.
1. A method for the detection of a signature in a data packet comprising a header and a payload, comprising:
defining a multiplicity of flows in a pre-classifier, each defined flow corresponding to one of a multiplicity of deterministic finite state machines, each corresponding deterministic finite state machine storing, as a sequence of states, a plurality of signatures representing threats in the corresponding defined flow;
applying selected fields of the header of the packet to the pre-classifier to determine to which of the multiplicity of defined flows said packet belongs wherein the pre-classifier defines a flow from a 5-tuple access control list; and
applying the payload of said packet to the corresponding one of the multiplicity of deterministic finite state machines.
2. A method as in claim 1 wherein said access control list comprises a network source address, a network destination address, an application source port, an application destination port and a protocol.
3. A method as in claim 1 wherein said defining a multiplicity of flows comprises defining separate flows of TCP packets and UDP packets.
4. A network unit organized for the detection of signatures in received packets, comprising:
a store for received data packets; a pre-classifier for the classification of a received packet into one of a multiplicity of defined flows wherein the pre-classifier defines a flow from a 5-tuple access control list;
a multiplicity of deterministic finite state machines, each corresponding to a different one of the defined flows and each of which stores, as a sequence of states, a plurality of signatures representing threats in the corresponding defined flow; and
a controller which directs a payload of said received packet from said store to a respective one of said multiplicity of deterministic finite state machines according to the corresponding defined flow as determined by said pre-classifier.
5. A network unit as in claim 4 and further comprising a residue deterministic finite state machine for the examination of packets which are outside any of said flows.
6. A network unit organized for the detection of signatures in received packets, comprising:
a store for received data packets;
processing engines including a post-processor for the development of a final forwarding bit mask for a received packet;
a pre-classifier for the classification of a received packet into one of a multiplicity of defined flows wherein the pre-classifier defines a flow from a 5-tuple access control list;
a multiplicity of deterministic finite state machines, each corresponding to a different one of the defined flows and each of which stores, as a sequence of states, a plurality of signatures representing threats in the corresponding defined flow; and
a controller which directs a payload of said received packet from said store to a respective one of said multiplicity of deterministic finite state machines according to the flow as determined by said pre-classifier; wherein each of the multiplicity of deterministic finite state machines is coupled to the post-processor to provide an instruction thereto in the event of detection of a signature match.
7. A network unit as in claim 6 and further comprising a residue deterministic finite state machine for the examination of packets which are outside any of said flows.
8. A network unit as in claim 6 wherein said multiplicity of deterministic finite state machines comprises a respective deterministic finite state machine for each of at least a TCP flow and a UDP flow.
9. A network unit as in claim 6 wherein said multiplicity of deterministic finite state machines comprises a respective deterministic finite state machine for each of at least a TCP flow, a UDP flow and an ICMP flow.
10. A network unit as in claim 4 wherein said access control list comprises a network source address, a network destination address, an application source port, an application destination port and a protocol.
11. A network unit as in claim 6 wherein said access control list comprises a network source address, a network destination address, an application source port, an application destination port and a protocol.