Method and apparatus for data normalization
View Patent ↗A method that allows the normalization of traffic data that is simultaneously transferred to a network intrusion detection system (NIDS) and monitored end-systems located in a network, such as a TCP/IP network, in which packets of data such as IP datagrams, are fragmented and reassembled. Accordingly, the information of received fragments and/or the topology of the network comprising the network intrusion detection system (NIDS) and the monitored end-systems are entered into a normalization table, that is dynamically established and maintained. Subsequently packets of data such as IP datagrams are modified, redirected or discarded in case that ambiguities are detected when comparing information contained in the normalization table with information contained in the headers of the received data packets.
1. A method for normalization of traffic data, received from an internet and transmitted to a local network, said method comprising:
dynamically establishing and maintaining a normalization table in a traffic normalizer, said traffic normalizer being interposed between said internet and said local network;
receiving a packet fragment from said internet at said traffic normalizer, said packet fragment being addressed to an end-system in said local network;
determining if an entry exists in said normalization table for said packet fragment, said entry including an identifier comprising identifying information from IDENTIFICATION, PROTOCOL, SOURCE IP ADDRESS, and DESTINATION IP ADDRESS header fields of said packet fragment;
if said entry exists in said normalization table, determining if a conflict exists between said entry and a prior entry;
if said conflict exists, discarding said packet fragment; and
if said conflict does not exist, simultaneously transferring said packet fragment to a network intrusion detection system and said end-system of said local network.
2. The method according to claim 1 , all the limitations of which are incorporated herein by reference, wherein said entry further includes information from IDENTIFICATION, FLAGS, and FRAGMENT OFFSET header fields of said packet fragment, said information allowing calculation of a length of said packet fragment.
3. The method according to claim 2 , all the limitations of which are incorporated herein by reference, wherein partial and complete receipt of a packet, comprising two or more packet fragments, is signaled by a sliding bit-mask that is moved to an offset, until said offset indicates receipt of all data of said packet.
4. The method according to claim 3 , all the limitations of which are incorporated herein by reference, wherein said entry further includes information corresponding to at least one of a pre-calculated TIME TO LIVE and a path Maximum Transfer Unit (MTU) to said end-system in said local network.
5. The method according to claim 4 , all the limitations of which are incorporated herein by reference, wherein:
when said pre-calculated TIME TO LIVE is less than a predetermined value, then said pre-calculated TIME TO LIVE replaces said predetermined value; and
when said path MTU is less than a length of said packet, a do not fragment FLAG is cleared.
6. The method according to claim 1 , all the limitations of which are incorporated herein by reference, wherein:
said dynamically establishing and maintaining comprises adding an aging bit to said entry; and
said aging bit is set whenever said entry is retrieved from said normalization table.
7. The method according to claim 6 , all the limitations of which are incorporated herein by reference, wherein said dynamically establishing and maintaining further comprises resetting said aging bit after a first period and deleting said entry with a previously set or reset aging bit.
8. The method according to claim 7 , all the limitations of which are incorporated herein by reference, wherein said dynamically establishing and maintaining further comprises determining, after a second time period, at least one of a pre-calculated TIME TO LIVE and a path MTU to said end system and updating said entry.
9. A method for normalization of traffic data, received from an internet and transmitted to a local network, said method comprising:
dynamically establishing and maintaining a normalization table in a traffic normalizer, said traffic normalizer being interposed between said internet and said local network;
receiving a packet fragment from said internet at said traffic normalizer, said packet fragment being addressed to an end-system in said local network;
determining if an entry exists in said normalization table for said packet fragment, said entry including an identifier comprising identifying information from IDENTIFICATION, PROTOCOL, SOURCE IP ADDRESS, and DESTINATION IP ADDRESS header fields of said packet fragment;
if said entry exists in said normalization table, determining if a conflict exists between said entry and a prior entry;
if said conflict exists, discarding said packet fragment;
if said conflict does not exist, determining if a length of said packet fragment based on information from IDENTIFICATION, FLAGS, and FRAGMENT OFFSET header fields of said packet fragment, fits a sliding bit-mask;
if said packet fragment does not fit said sliding bit-mask, redirecting said packet fragment; and
if said packet fragment does fit said sliding bit-mask, simultaneously transferring said packet fragment to a network intrusion detection system and said end-system of said local network.
10. The method according to claim 9 , all the limitations of which are incorporated herein by reference, wherein partial and complete receipt of a packet, comprising two or more packet fragments, is signaled by a sliding bit-mask that is moved to an offset, until said offset indicates receipt of all data of said packet.
11. The method according to claim 10 , all the limitations of which are incorporated herein by reference, wherein said entry further includes information corresponding to at least one of a pre-calculated TIME TO LIVE and a path Maximum Transfer Unit (MTU) to said end-system in said local network.
12. The method according to claim 11 , all the limitations of which are incorporated herein by reference, wherein:
when said pre-calculated TIME TO LIVE is less than a predetermined value, then said pre-calculated TIME TO LIVE replaces said predetermined value; and
when said path MTU is less than a length of said packet, a do not fragment FLAG is cleared.
13. A program storage device readable by machine, tangibly embodying a program of instructions executable by said machine to perform a method for normalization of traffic data, received from an internet and transmitted to a local network, said method comprising:
dynamically establishing and maintaining a normalization table in a traffic normalizer, said traffic normalizer being interposed between said internet and said local network;
receiving a packet fragment from said internet at said traffic normalizer, said packet fragment being addressed to an end-system in said local network;
determining if an entry exists in said normalization table for said packet fragment, said entry including an identifier comprising identifying information from IDENTIFICATION, PROTOCOL, SOURCE IP ADDRESS, and DESTINATION IP ADDRESS header fields of said packet fragment;
if said entry exists in said normalization table, determining if a conflict exists between said entry and a prior entry;
if said conflict exists, discarding said packet fragment; and
if said conflict does not exist, simultaneously transferring said packet fragment to a network intrusion detection system and said end-system of said local network.
14. The program storage device according to claim 13 , all the limitations of which are incorporated herein by reference, wherein:
said dynamically establishing and maintaining comprises adding an aging bit to said entry; and
said aging bit is set whenever said entry is retrieved from said normalization table.