Methods and systems for intrusion detection
US7305708B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Mar 8, 2004 |
| Grant date | Dec 4, 2007 |
| Priority date | — |
| Expiry date | Feb 15, 2026 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/14
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
Performance of an intrusion detection system is enhanced with the addition of rule optimization, set-based rule inspection, and protocol flow analysis. During rule optimization, rule sets are created and selected in such a way that for every incoming packet only a single rule set has to be searched. Set-based rule inspection divides rules into content and non-content type rules. Only search patterns of content type rules are initially compared to a packet. Rules containing matched search patterns are validated with a parameterized search against the packet. Matches are recorded as events. Non-content rules are searched against a packet using a parameterized search. These matches are also recorded as an event. At least one event is selected per packet for logging. Protocol flow analysis determines the direction of flow of network traffic. Based on the direction of flow and the protocol, portions of packets can be eliminated from rule inspection.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.