Detecting public network attacks using signatures and fast content analysis
US7966658B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Apr 8, 2004 |
| Grant date | Jun 21, 2011 |
| Priority date | — |
| Expiry date | Dec 21, 2029 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L2463/141
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
Detecting attacks against computer systems by automatically detecting signatures based on predetermined characteristics of the intrusion. One aspect looks for commonalities among a number of different network messages, and establishes an intrusion signature based on those commonalities. Data reduction techniques, such as a hash function, are used to minimize the amount of resources which are necessary to establish the commonalities. In an embodiment, signatures are created based on the data reduction hash technique. Frequent signatures are found by reducing the signatures using that hash technique. Each of the frequent signatures is analyzed for content, and content which is spreading is flagged as being a possible attack. Additional checks can also be carried out to look for code within the signal, to look for spam, backdoors, or program code.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.