Method and an apparatus to perform multiple packet payloads analysis
A method and an apparatus to perform multiple packet payload analysis have been disclosed. In one embodiment, the method includes receiving a plurality of data packets, each of the plurality of data packets containing a portion of a data pattern, determining whether each of the plurality of data packets is out of order, and making and storing a local copy of the corresponding data packet if the corresponding data packet is out of order. Other embodiments have been claimed and described.
1. An attack signature detection device, the device comprising:
a network interface that receives a plurality of data packets, each data packet containing an alphanumeric character; and
a processor that executes instructions stored in a memory, wherein execution of the instructions by the processor:
matches a portion of the received data packets to a first predetermined pattern by comparing each of a first set of one or more alphanumeric characters of each packet to a first state of a plurality of states stored in memory, wherein the first state of the plurality of states is predefined to correspond to a first alphanumeric character,
matches a portion of the received data packets to a second predetermined pattern by comparing each of a second set of one or more alphanumeric characters of each packet to a second state of the plurality of states stored in memory, wherein the second state of the plurality of states is predefined to correspond to a second alphanumeric character, and
detects an attack signature formed by the first and second predetermined patterns, the detection based on the matched portions of the received data packets and the first and second predetermined patterns.
2. The attack signature detection device of claim 1 , wherein the memory stores a logical pointer that tracks which of the first or second predetermined patterns is being matched.
3. The attack signature detection device of claim 1 , wherein the memory stores a data structure that tracks which of the first or second predetermined patterns is being matched.
4. The attack signature detection device of claim 3 , wherein the data structure is a tree structure.
5. The attack signature detection device of claim 4 , wherein the stored tree structure includes a plurality of nodes, the nodes including a first node corresponding to the first predetermined pattern and a second node corresponding to the second predetermined pattern.
6. The attack signature detection device of claim 1 , wherein further execution of the instructions by the processor prevents the detected attack signature from being transmitted to a recipient device.
7. The attack signature detection device of claim 1 , wherein further execution of the instructions by the processor alerts a system administrator when the attack signature is detected.
8. The attack signature detection device of claim 1 , wherein comparing each of the second set of one or more alphanumeric characters of each packet to the second state of the plurality of states stored in memory includes advancing to the second state of the plurality of states when the second set of the one or more alphanumeric characters matches the second alphanumeric character.
9. The attack signature detection device of claim 1 , wherein comparing each of the second set of one or more alphanumeric characters of each packet to the second state of the plurality of states stored in memory includes remaining in the first state when the second set of the one or more alphanumeric characters does not match the second alphanumeric character.
10. The attack signature detection device of claim 1 , wherein comparing each of a third set of one or more alphanumeric characters of each packet to the third state of the plurality of states stored in memory includes transitioning back to a first state of the plurality of states when the third set of one or more alphanumeric characters does not match a third alphanumeric character of a third predetermined pattern.
11. The attack signature detection device of claim 1 , wherein the first and second predetermined patterns are application layer patterns.
12. A non-transitory computer-readable storage medium having a computer program embodied thereon, the computer program executable by a processor to perform a method of detecting attack signatures, the method comprising:
matching a portion of a plurality of received data packets to a first predetermined pattern, each data packet containing an alphanumeric character, wherein matching the packets to the first predetermined pattern includes comparing each of a first set of one or more alphanumeric characters of each packet to a first state of a plurality of states stored in memory, the first state of the plurality of states predefined to correspond to a first alphanumeric character;
matching a portion of the received data packets to a second predetermined pattern, wherein matching the packets to the second predetermined pattern includes comparing each of a second set of one or more alphanumeric character of each packet to a second state of a plurality of states stored in memory, the second state of the plurality of states predefined to correspond to a second alphanumeric character; and
detecting an attack signature formed by the first and second predetermined patterns, the detection based on the matched portions of the received data packets and the first and second predetermined patterns.
13. The non-transitory computer-readable storage medium of claim 12 , wherein the method further comprises tracking which of the first and second predetermined patterns is being matched, the tracking including the use of a logical pointer stored in memory.
14. The non-transitory computer-readable storage medium of claim 12 , wherein the method further comprises tracking which of the first and second predetermined patterns is being matched, the tracking including the use of a data structure stored in memory.
15. The non-transitory computer-readable storage medium of claim 14 , wherein the data structure is a tree structure.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the tree structure includes a plurality of nodes, the nodes including a first node corresponding to the first predetermined pattern and a second node corresponding to the second predetermined pattern.
17. The non-transitory computer-readable storage medium of claim 12 , wherein the method further comprises preventing the detected attack signature from being transmitted to a recipient device.
18. The non-transitory computer-readable storage medium of claim 12 , wherein comparing each of the second set of one or more alphanumeric characters of each packet to the second state of the plurality of states stored in memory includes advancing to the second state of the plurality of states when the second set of the one or more alphanumeric characters matches the second alphanumeric character.
19. The non-transitory computer-readable storage medium of claim 12 , wherein comparing each of the second set of one or more alphanumeric characters of each packet to the second state of the plurality of states stored in memory includes remaining in the first state when the second set of the one or more alphanumeric characters does not match the second alphanumeric character.
20. The non-transitory computer-readable storage medium of claim 12 , wherein comparing each of a third set of one or more alphanumeric characters alphanumeric character of each packet to the third state of the plurality of states stored in memory includes transitioning back to a first state of the plurality of states when the third set of one or more alphanumeric characters does not match a third alphanumeric character of a third predetermined pattern.