Network intrusion detector with combined protocol analyses, normalization and matching
A network intrusion detection system combines the normally sequential steps of protocol analysis, normalization, and signature matching through the use of a regular expression to speed the monitoring of network data. The regular expression also allows the creation of a superset matcher, permitting multiple stages of matching of increased accuracy to produce additional throughput gains.
1. A network intrusion monitor comprising:
a network connection receiving data strings;
an electronic memory holding a plurality of regular expressions, each regular expression providing in combination at least one of the processes of: protocol analysis and normalization, together with the process of matching to malware signatures, a match of a data string with the regular expression indicating that the string is a portion of a malware data string;
an electronic computer communicating with the network and memory and executing a stored program to:
read a string from the network;
apply the string against a regular expression, in one processing of the string, to provide each of the processes of: a protocol analysis and normalization, together with the process of matching to malware signatures to detect a match without separate readings of the string from the network for the separate processes; and
output an alarm signal indicating when the string has matched to a malware signature as indicated by the match;
wherein the electronic memory further holds superset regular expressions matching both known malware strings and known benign strings and wherein the electronic computer after reading a string from the network and before applying the string against the regular expression executes the stored program to:
apply the string against the superset regular expression in one processing of the string to provide in combination each of the processes of: protocol analysis, normalization, and signature matching of the string; and
when the superset regular expression matches the string, proceeding to the step of applying the string against the regular expression and otherwise returning to the step of reading a string from the network for a new string from the network.
2. The network intrusion monitor of claim 1 wherein the regular expression identifies a pattern matching at least two different strings.
3. The network intrusion monitor of claim 2 wherein pattern matches all equivalent encodings of a string under a given protocol.
4. The network intrusion monitor of claim 2 wherein pattern identifies protocol elements associated with the string.
5. The network intrusion monitor of claim 2 wherein the pattern matches multiple different malware types.
6. The network intrusion monitor of claim 2 wherein the pattern matches both known benign and known malicious strings.
7. The network intrusion monitor of claim 1 wherein the regular expression is implemented as a finite state machine.
8. The network intrusion monitor of claim 7 wherein the finite state machine includes references to secondary state machines stored in memory independently from the finite state machines, the secondary state machines providing one of protocol analysis, normalization or matching that may be invoked by multiple finite state machines.
9. A method of network intrusion monitoring comprising the steps of:
reading a string from the network with an electronic computer executing a stored program;
further executing the stored program on the electronic computer to apply the string to a regular expression stored in an electronic memory, in one processing of the string, to provide each of the processes of: protocol analysis and normalization, together with the process of matching against malware signatures without separate readings of the string for the separate processes, a match of the string with the regular expression indicating that the string is a portion of a malware data string; and
outputting from the electronic computer an alarm signal indicating when the string has matched to a malware signature;
wherein the electronic memory further holds superset regular expressions matching both known malware strings and known benign strings and wherein the electronic computer after the step of reading a string from the network and before the step of applying the string against the superset regular expression executes the stored program to:
(a) apply the string against the superset regular expression in one processing of the string to provide in combination each of the processes of: protocol analysis, normalization, and signature matching of the string; and
(b) when the superset regular expression matches the string, proceeding to the step of applying the string against the superset regular expression and otherwise returning to the step of reading a string from the network for a new string from the network.
10. The method of claim 9 wherein the regular expression identifies a pattern matching at least two different strings.
11. The method of claim 10 wherein pattern matches all equivalent encodings of a string under a given protocol.
12. The method of claim 10 wherein pattern identifies protocol elements associated with the string.
13. The method of claim 10 wherein the pattern matches multiple different malware types.
14. The method of claim 10 wherein the pattern matches both known benign and known malicious strings.
15. The method of claim 9 wherein the regular expression is implemented as a finite state machine.
16. The method of claim 15 wherein the finite state machine includes references to secondary state machines stored in memory independently from the finite state machine, the secondary state machines providing one of protocol analysis, normalization or matching that may be invoked multiple times by the finite state machine.