Method and apparatus to perform multiple packet payloads analysis
A method and apparatus for identifying data patterns of a file are described herein. In one embodiment, an exemplary process includes, but is not limited to, receiving a data packet of a data stream containing a file segment of a file originated from an external host and destined to a protected host of a local area network (LAN), the file being transmitted via multiple file segments contained in multiple data packets of the data stream, and performing a data pattern analysis on the received data packet to determine whether the received data packet contains a predetermined data pattern, without waiting for a remainder of the data stream to arrive. Other methods and apparatuses are also described.
1. A method for performing re-assembly free deep packet inspection, the method comprising:
receiving a data stream over a communication network, the received data stream comprising a plurality of data packets ordered in a predetermined order;
identifying that the plurality of data packets are not being received in the predetermined order, wherein at least one data packet is received before a precedent data packet in the predetermined order is received and is an out-of-order packet of a plurality of out-of-order data packets;
storing the plurality of out-of-order data packets in a buffer, such that the buffer includes each of the out-of-order packets including the at least one data packet;
transmitting each of the plurality of packets received out-of-order to a recipient except for the at least one data packet; and
receiving a first set of other data packets of the data stream;
identifying that the first set of other data packets and each of the data packets stored in the buffer can be scanned in order except for the at least one data packet;
scanning in order each of the data packets stored in the buffer and the first set of other data packets except for the at least one data packet; and
transmitting each of the each of the data packets stored in the buffer and the first set of other data packets to the recipient except for the at least one data packet, wherein the at least one data packet is prevented from being transmitted to the recipient until verification that previous scanned packets when combined with the at least one data packet do not contain an attack pattern.
2. The method of claim 1 , further comprising:
receiving a second set of data packets in the data stream;
identifying at least one data packet from the second set of data packets is a subsequent packet to the at least one data packet;
identifying that the second set of data packets and the at least one data packet can be scanned in order except for the at least one identified data packet from the second set of data packets;
scanning the second set of other data packets and the at least one data packet except for the at least one identified packet from the second set of data packets; and
transmitting the second set of data packets and the at least one data packet to the recipient except for the at least one identified packet from the second set of data packets, wherein the at least one identified data packet from the second set of data packets is prevented from being transmitted to the recipient until verification that other previously scanned packets when combined with the at least one identified data packet from the second set of data packets do not contain the attack pattern.
3. The method of claim 1 , wherein the a state of pattern matching is stored after one or more data packets of the plurality of data packets of the data stream are scanned.
4. The method of claim 3 , wherein each of the one or more data packets are decoded before they are scanned.
5. The method of claim 3 , wherein each of the one or more data packets are decompressed before they are scanned.
6. The method of claim 3 , wherein the state of pattern matching is tracked by a pointer that points to at least one state in a series of states where each of the states in the series of states from an initial state to an end state correspond to the attack pattern.
7. The method of claim 6 , wherein the attack pattern is detected when a current state of pattern matching corresponds to an end state of a series of states corresponding to a previously identified pattern including at least one of a digit or at least one character.
8. A non-transitory computer readable storage medium having embodied thereon a program executable by a processor to perform a method for re-assembly free deep packet inspection, the method comprising:
receiving a data stream over a communication network, the received data stream comprising a plurality of data packets ordered in a predetermined order;
identifying that the plurality of data packets are not being received in the predetermined order, wherein at least one data packet is received before a precedent data packet in the predetermined order is received and is an out-of-order packet of a plurality of out-of-order data packets;
storing the plurality of out-of-order data packets in a buffer, such that the buffer includes each of the out-of-order packets including the at least one data packet;
transmitting each of the plurality of packets received out-of-order to a recipient except for the at least one data packet; and
receiving a first set of other data packets of the data stream;
identifying that the first set of other data packets and each of the data packets stored in the buffer can be scanned in order except for the at least one data packet;
scanning in order each of the data packets stored in the buffer and the first set of other data packets except for the at least one data packet; and
transmitting each of the each of the data packets stored in the buffer and the first set of other data packets to the recipient except for the at least one data packet, wherein the at least one data packet is prevented from being transmitted to the recipient until verification that previous scanned packets when combined with the at least one data packet do not contain an attack pattern.
9. The non-transitory computer readable storage medium of claim 8 , further comprising instructions executable to:
receive a second set of data packets in the data stream;
identify at least one data packet from the second set of data packets is a subsequent packet to the at least one data packet;
identify that the second set of data packets and the at least one data packet can be scanned in order except for the at least one identified data packet from the second set of data packets;
scan the second set of data packets and the at least one data packet except for the at least one identified data packet from the second set of data packets; and
transmit the second set of data packets and the at least one data packet to the recipient except for the at least one identified data packet from the second set of data packets, wherein the at least one identified data packet from the second set of data packets is prevented from being transmitted to the recipient until verification that other previously scanned packets when combined with the at least one identified data packet from the second set of data packets do not contain the attack pattern.
10. The non-transitory computer readable storage medium of claim 8 , wherein the a state of pattern matching is stored after one or more data packets of the plurality of data packets of the data stream are scanned.
11. The non-transitory computer readable storage medium of claim 10 , wherein each of the one or more data packets are decoded before they are scanned.
12. The non-transitory computer readable storage medium of claim 10 , wherein each of the one or more data packets are decompressed before they are scanned.
13. The non-transitory computer readable storage medium of claim 10 , wherein the state of pattern matching is tracked by a pointer that points to at least one state in a series of states where each of the states in the series of states from an initial state to an end state correspond to the attack pattern.
14. The non-transitory computer readable storage medium of claim 13 , wherein the attack pattern is detected when a current state of pattern matching corresponds to an end state of a series of states corresponding to a previously identified pattern including at least one of a digit or at least one character.
15. An apparatus that performs re-assembly free deep packet inspection, the system comprising:
a first network communication interface that receives a data stream, the received data stream comprising a plurality of data packets ordered in a predetermined order;
a memory;
a processor executing instructions out of the memory to:
identify that the plurality of data packets are not being received in the predetermined order, wherein at least one data packet is received before a precedent data packet in the predetermined order is received and is an out-of-order packet of a plurality of out-of-order data packets, and
store the plurality of out-of-order data packets in a buffer, such that the buffer includes each of the out-of-order packets including the at least one data packet; and
a second network communication interface that transmits each of the plurality of packets received out-of-order to a recipient except for the at least one data packet, wherein:
a first set of other data packets of the data stream are received over the first data communication interface,
the processor executing the instructions out of the memory identifies that the first set of other data packets and each of the data packets stored in the buffer can be scanned in order except for the at least one data packet,
the processor executing the instructions out of the memory scans in order each of the data packets stored in the buffer and the first set of other data packets except for the at least one data packet,
each of the data packets stored in the buffer and the first set of other data packets except for the at least one data packet are transmitted to the recipient, wherein the at least one data packet is prevented from being transmitted to the recipient until verification that previous scanned packets when combined with the at least one data packet do not contain an attack pattern.
16. The apparatus of claim 15 , wherein:
a second set of data packets in the data stream is received;
at least one data packet from the second set of data packets is identified as a subsequent packet to the at least one data packet;
the second set of data packets and the at least one data packet except for the at least one identified data packet from the second set of data packets are scanned; and
the second set of data packets and the at least one data except for the at least one identified data packet from the second set of data packets are transmitted to the recipient, wherein the at least one identified data packet from the second set of data packets is prevented from being transmitted to the recipient until verification that other previously scanned packets when combined with the at least one identified data packet from the second set of data packets do not contain the attack pattern.
17. The apparatus of claim 15 , wherein the a state of pattern matching is stored after one or more data packets of the plurality of data packets of the data stream are scanned.
18. The apparatus of claim 17 , wherein each of the one or more data packets are decoded before they are scanned.
19. The apparatus of claim 17 , wherein each of the one or more data packets are decompressed before they are scanned.
20. The apparatus of claim 17 , wherein the state of pattern matching is tracked by a pointer that points to at least one state in a series of states where each of the states in the series of states from an initial state to an end state correspond to the attack pattern.