System, method, and computer program product for analyzing a protocol utilizing a state machine based on a token determined utilizing another state machine
View Patent ↗A system, method, and computer program product are provided for analyzing a protocol utilizing a state machine, based on a token determined utilizing another state machine. In use, a state of a protocol used within a data stream is identified. Additionally, at least one taken capable of initiating a change in the state of the protocol used within the data stream is determined utilizing a first state machine. Furthermore, the protocol is analyzed based on the at least one token, utilizing a second state machine.
1. A method, comprising:
identifying a state of a protocol used within a data stream;
determining, utilizing a first state machine, at least one token capable of initiating a change in the state of the protocol used within the data stream;
determining whether the token includes at least a portion of a uniform resource locator (URL), which is indicative of unwanted data;
analyzing, utilizing a second state machine, the protocol based on the at least one token; and
performing one or more transition operations associated with the at least one token, wherein the one or more transition operations include changing the state of the second state machine, and wherein a match between data in the data stream and known unwanted data indicates that at least a portion of the data stream includes unwanted data.
2. The method as set forth in claim 1 , wherein the first state machine includes a software pattern matching state machine.
3. The method as set forth in claim 1 , wherein the determining includes comparing predefined data with one or more portions of the data stream.
4. The method as set forth in claim 3 , wherein the at least one token is determined based on a match of the predefined data and the one or more portions of the data stream.
5. The method as set forth in claim 3 , wherein the predefined data includes a signature.
6. The method as set forth in claim 5 , wherein the signature is particular to the state of the protocol.
7. The method as set forth in claim 1 , wherein the second state machine includes a virtual machine.
8. The method as set forth in claim 1 , wherein the second state machine communicates a current state of the protocol used within the data stream to the first state machine.
9. The method as set forth in claim 8 , wherein the second state machine communicates the current state utilizing a return to a callback function return.
10. The method as set forth in claim 1 , further comprising identifying one or more transition operations associated with the at least one token, utilizing the second state machine.
11. The method as set forth in claim 1 , further comprising communicating the at least one token to the second state machine.
12. The method as set forth in claim 1 , further comprising communicating an identifier of the at least one token to the second state machine.
13. The method as set forth in claim 1 , further comprising determining whether the data stream includes unwanted data, based on the analysis.
14. The method as set forth in claim 1 , wherein the at least one token is communicated to the second state machine when it is determined by the first state machine that all possible tokens have been identified with respect to the data stream.
15. The method as set forth in claim 1 , wherein the at least one token is communicated to the second state machine in an order relative to size of the at least one token.
16. The method as set forth in claim 1 , wherein the state of the protocol used within the data stream is included in a list particular to the protocol and includes one of an open state, a closed state, a start state, and an accept state.
17. A computer program product embodied on a non-transitory computer readable medium for performing operations, comprising:
identifying a state of a protocol used within a data stream;
determining, utilizing a first state machine, at least one token capable of initiating a change in the state of the protocol used within the data stream;
determining whether the token includes at least a portion of a uniform resource locator (URL), which is indicative of unwanted data;
analyzing, utilizing a second state machine, the protocol based on the at least one token; and
performing one or more transition operations associated with the at least one token, wherein the one or more transition operations include changing the state of the second state machine, and wherein a match between data in the data stream and known unwanted data indicates that at least a portion of the data stream includes unwanted data.
18. A system, comprising:
a processor;
a first state machine for determining at least one token capable of initiating a change in a state of a protocol used within a data stream; and
a second state machine for analyzing the protocol based on the at least one token;
wherein a determination is made whether the at least one token includes at least a portion of a uniform resource locator (URL), which is indicative of unwanted data, and wherein one or more transition operations associated with the at least one token are performed, and wherein the one or more transition operations include changing the state of the second state machine, and wherein a match between data in the data stream and known unwanted data indicates that at least a portion of the data stream includes unwanted data.
19. The system as set forth in claim 18 , wherein the first state machine and the second state machine are in communication with memory via a bus.