Method and system for dynamic protocol decoding and analysis

1. A method for dynamic protocol decoding, comprising:

employing at least one hardware processor for:

(a) providing a protocol decoding program adapted to analyze data received from a network in an intrusion detection system, the protocol decoding program comprising concrete type instructions of at least two types and pseudo type instructions of at least two types, each concrete type instruction implying a different value specifying a number of bytes and causing reading of a data unit of a data packet, a length of said data unit being the number of bytes defined by the respective concrete type instruction, each concrete type instruction being followed by one or more pseudo type instructions, including a pseudo type instruction of a type for operating on data contained in data units already read by concrete type instructions, the pseudo type instructions further comprising at least one pseudo type instruction of a type for controlling a program flow of the protocol decoding program;

(b) analyzing the data packet, comprising

executing the protocol decoding program including:

(i) executing the concrete type instruction, the concrete type instruction causing a next data unit in the data packet to be read in sequence, the length of the next data unit being specified by the concrete type instruction being executed;

the number of bytes to be read being dynamically defined by the concrete type instruction being executed as a parameter of said concrete type instruction, a value of the parameter being fixed;

(ii) executing the pseudo type instruction following the execution of the concrete type instruction;

(iii) provided a predefined condition regarding the data unit read in the step (i) is met, triggering a rule of the protocol decoding program, comprising triggering the rule by at least one of a data pattern, a signalled event, or a counter; and

(iv) repeating the steps (i)-(iii) until the data packet is decoded or the analyzing step is terminated by the rule triggered in the step (iii).

2. The method of claim 1 , wherein the step of analyzing comprises analyzing the data packet of a data stream.

3. The method of claim 1 , further comprising executing a corresponding rule instruction associated with the rule triggered in the step (iii).

4. The method of claim 1 , wherein the step (iii) comprises at least one of the following:

generating an exception according to an exception handling mechanism;

terminating the analyzing step provided a predefined length of the data packet or the data unit read in the step (i) is exceeded;

recovering the protocol decoding program upon encountering an error;

triggering a rule provided the predefined condition comprises finding a predefined data pattern in the data unit read in the step (i).

5. The method of claim 1 , wherein the step (iii) comprises changing the data packet.

6. The method of claim 1 , wherein the analyzing comprises providing a plurality of state machines, each state machine processing data units of a corresponding layer of a data packet, the data packet being configured in accordance with a multi-layered protocol.

7. The method of claim 1 , wherein the concrete type instruction is defined by another parameter of a pseudo type instruction executed prior to execution of said concrete type instruction.

8. The method of claim 1 , wherein the number of bytes to be read in the step (i) is dynamically defined by the concrete type instruction being executed as a number of bytes read until a terminating byte value is encountered in the data packet, the terminating byte value being defined by a parameter of said concrete type instruction.

9. The method of claim 1 , wherein the concrete type instructions comprise at least two concrete type instructions, a first concrete type instruction specifying a length of one (1) byte, and a second concrete type instruction specifying a length of four (4) bytes.

10. A system for dynamic protocol decoding, comprising:

at least one hardware processor;

a memory device having computer readable instructions stored thereon for execution by the processor, the computer readable instructions forming a protocol decoding program comprising concrete type instructions of at least two types and pseudo type instructions of at least two types, each concrete type instruction implying a different value specifying a number of bytes, and causing reading of a data unit of a data packet, a length of said data unit being the number of bytes defined by the respective concrete type instruction, each concrete type instruction being followed by one or more pseudo type instructions, including a pseudo type instruction of a type for operating on data contained in data units already read by concrete type instructions, the pseudo type instructions further comprising at least one pseudo type instruction of a type for controlling a program flow of the protocol decoding program, and causing the processor to:

analyze the data packet, comprising:

executing the protocol decoding program, comprising:

(i) executing the concrete type instruction, the concrete type instruction causing a next data unit in the data packet to be read in sequence, the length of the next data unit being specified by the concrete type instruction being executed;

the number of bytes to be read being dynamically defined by the concrete type instruction being executed as a parameter of said concrete type instruction, a value of the parameter being fixed;

(ii) executing the pseudo type instruction following the execution of the concrete type instruction;

(iii) provided a predefined condition regarding the data unit read in the step (i) is met, triggering a rule of the protocol decoding program, comprising triggering the rule by at least one of a data pattern, a signalled event, or a counter; and

(iv) repeating the steps (i)-(iii) until the data packet is decoded or the analyzing step is terminated by the rule triggered in the step (iii).

11. The system of claim 10 , wherein the computer readable instructions further cause the processor to analyze the data packets of a data stream.

12. The system of claim 10 , wherein the computer readable instructions further cause the processor to execute a corresponding rule instruction associated with the rule triggered in the step (iii).

13. The system of claim 10 , wherein the computer readable instructions further cause the processor in the step (iii) to perform at least one of the following:

generate an exception according to an exception handling mechanism;

terminate the analyzing step provided a predefined length of the data packet or a data unit is exceeded;

recovering the protocol decoding program upon encountering an error;

trigger a rule provided the predefined condition comprises finding a predefined data pattern in the data unit read in the step (i).

14. The system of claim 10 , wherein the computer readable instructions further cause the processor in the step (iii) to change the data packet.

15. The system of claim 10 , wherein the computer readable instructions comprise a plurality of state machines, each state machine for processing data units of a corresponding layer of a data packet, the data packet being configured in accordance with a multi-layered protocol.

16. The system of claim 10 , wherein the concrete type instruction is defined by another parameter of a pseudo type instruction executed prior to execution of said concrete type instruction.

17. The system of claim 10 , wherein the number of bytes to be read in the step (i) is dynamically defined by the concrete type instruction being executed as a number of bytes read until a terminating byte value is encountered in the data packet, the terminating byte value being defined by a parameter of said concrete type instruction.

18. The system of claim 10 , wherein the concrete type instructions comprise at least two concrete type instructions, a first concrete type instruction specifying a length of one (1) byte, and a second concrete type instruction specifying a length of four (4) bytes.