Method and an apparatus to perform multiple packet payloads analysis
View Patent ↗A method and an apparatus to perform multiple packet payload analysis have been disclosed. In one embodiment, the method includes receiving a plurality of data packets, each of the plurality of data packets containing a portion of a data pattern, determining whether each of the plurality of data packets is out of order, and making and storing a local copy of the corresponding data packet if the corresponding data packet is out of order. Other embodiments have been claimed and described.
1. A method comprising:
representing a plurality of attack patterns to be matched in a plurality of deterministic finite automata, wherein a plurality of data packets are compared with one or more of the plurality of deterministic finite automata;
receiving the plurality of data packets at an intrusion detection/prevention system (IPS), each of the plurality of data packets containing a portion of a data pattern;
determining, for each of the plurality of data packets, whether a corresponding data packet is out of order;
if the corresponding data packet is out of order,
making and storing a local copy of the corresponding data packet, wherein the local copy is to be used in pattern matching to scan for an attack pattern of the plurality of attack patterns so that at least one of a plurality of packets containing portions of that attack pattern is blocked,
passing the corresponding data packet, and
performing pattern matching on the local copy and a subsequently received one of the plurality of data packets against at least a portion of the attack pattern to determine whether these data packets received so far contain the attack data pattern, wherein the local copy and the subsequently received one of the plurality of data packets are in a same sequence of data packets; and
if the corresponding data packet is in order,
performing pattern matching on the corresponding data packet against at least a portion of the attack pattern to determine whether one or more of the data packets received so far contain the attack data, and
passing the corresponding data packet if the one or more data packets compared partially match, but do not fully match, the attack pattern.
2. The method of claim 1 , wherein the passing the corresponding data packet if the corresponding data packet is out of order is after the making and storing of the local copy of the corresponding data packet.
3. The method of claim 1 , wherein the pattern matching is performed in a plurality of states, each of the plurality of states corresponds to one of a plurality of segments of the attack pattern.
4. The method of claim 3 , wherein performing the pattern matching comprises:
storing a current state of the pattern matching after performing the pattern matching on a data packet.
5. The method of claim 4 , further comprising:
looking up the stored state when a next data packet is received; and
performing pattern matching on the next data packet from the stored state.
6. The method of claim 1 , further comprising:
blocking the corresponding data packet if the one or more data packets compared so far contain the attack pattern.
7. The method of claim 6 , further comprising:
determining whether there is any in-order data packets stored locally; and
if there is one or more locally stored in-order data packets, performing pattern matching on the one or more locally stored in-order data packets against at least a portion of the attack pattern.
8. The method of claim 1 , wherein determining whether the corresponding data packet is out of order comprises checking a sequence number in the corresponding data packet.
9. An apparatus comprising:
an interface to receive data packets; and
a processor to represent a plurality of attack patterns to be matched in a plurality of deterministic finite automata, wherein the data packets are compared with one or more of the plurality of deterministic finite automata, to determine, for each of the data packets, whether a corresponding data packet is out of order, if the corresponding data packet is out of order, to make and store a local copy of the corresponding data packet, wherein the local copy is to be used in pattern matching to scan for an attack pattern of the plurality of attack patterns so that at least one of a plurality of packets containing portions of that attack pattern is blocked, to pass the corresponding data packet, and performing pattern matching on the local copy and a subsequently received one of the data packets against at least a portion of the attack pattern to determine whether these data packets received so far contain the attack data pattern, wherein the local copy and the subsequently received one of the data packets are in a same sequence of data packets, and if the corresponding data packet is in order, to perform pattern matching on the corresponding data packet against at least a portion of the attack pattern to determine whether one or more of the data packets received so far contain the attack data pattern, and to pass the corresponding data packet if the one or more data packets compared partially match, but do not fully match, the attack pattern.
10. The apparatus of claim 9 , further comprising a buffer to temporarily store a copy of the data packet if the data packet is out of order before allowing the data packet to pass.
11. The apparatus of claim 9 , wherein the attack pattern includes a plurality of data patterns and the processor is operable to represent each of the plurality of data patterns with a Deterministic Finite Automaton (DFA) and to perform the pattern matching on the received data packets against the attack pattern using the DFA.
12. The apparatus of claim 11 , further comprising a storage device to store a current state of the DFA such that the pattern matching is performed on a next data packet from the stored state if the next data packet is in order.
13. The apparatus of claim 12 , wherein the storage device comprises a logical pointer.
14. A system comprising:
at least one client application;
a network; and
an intrusion detection/prevention system (IPS) communicably coupled between the at least one client application and the network, the IPS comprising:
an interface to receive data packets; and
a processor to represent a plurality of attack patterns to be matched in a plurality of deterministic finite automata, wherein the data packets are compared with one or more of the plurality of deterministic finite automata, to determine, for each of the data packets, whether a corresponding data packet is out of order, if the corresponding data packet is out of order, to make and store a local copy of the corresponding data packet, wherein the local copy is to be used in pattern matching to scan for an attack pattern of the plurality of attack patterns so that at least one of a plurality of packets containing portions of that attack pattern is blocked, to pass the corresponding data packet, and to perform pattern matching on the local copy and a subsequently received one of the data packets against at least a portion of the attack pattern to determine whether these data packets received so far contain the attack data pattern, wherein the local copy and the subsequently received one of the data packets are in a same sequence of data packets, and if the corresponding data packet is in order, performing pattern matching on the corresponding data packet against at least a portion of the attack pattern to determine whether one or more of the data packets received so far contain the attack data pattern, and to pass the corresponding data packet if the one or more data packets compared partially match, but do not fully match, the attack pattern.
15. The system of claim 14 , wherein the IPS further comprises a buffer to temporarily store a copy of the data packet if the data packet is out of order before allowing the data packet to pass.
16. The system of claim 14 , wherein the attack pattern includes a plurality of data patterns and the processor is operable to represent each of the plurality of data patterns with a Deterministic Finite Automaton (DFA) and to perform the pattern matching on the received data packets against the attack pattern using the DFA.
17. The system of claim 16 , wherein the IPS further comprises a storage device to store a current state of the DFA such that the pattern matching is performed on a next data packet from the stored state if the next data packet is in order.
18. The system of claim 17 , wherein the storage device comprises a logical pointer.
19. The system of claim 14 , further comprising a client machine, wherein the IPS is operable to run on the client machine.
20. The system of claim 14 , further comprising a router, wherein the IPS is operable to run on the router.
21. The system of claim 14 , further comprising a server, wherein the IPS is operable to run on the server.