Content Inspection Co-processor for Real-time Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security approaches, such as firewalls and anti-virus programs, fail to effectively inspect payload data and handle malicious code segments that span packet boundaries, particularly for real-time protocols, rendering them inoperable against certain types of attacks.
Innovation Solution
The system employs a content inspection co-processor that splits regular expressions into sub-expressions, maintains dependency relationships among finite automata, and uses these automata to search for unwanted patterns within data units, including decompressing and monitoring for anomalies that cannot be described by regular expressions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If anti-virus programs assemble incoming packets into a file before scanning for virus patterns, then storage requirements are reduced, but real-time protocol attacks cannot be detected in time
Solution Approach 1:
The patent divides the file scanning process into packet-level segments. Instead of assembling complete files before scanning, the system scans individual packets or packet fragments as they arrive, enabling real-time detection while maintaining reduced storage requirements. The finite automata process each packet independently to identify malicious patterns.
Solution Approach 2:
The system performs preliminary scanning actions on packet data before complete file assembly occurs. By using finite automata to pre-process and identify malicious patterns in incoming packets, the system detects threats in real-time while avoiding the need to store complete files for scanning.
2Reliability
If firewalls inspect control information of each packet based on user-defined rules, then network security is improved, but payload data containing malicious code segments spanning packet boundaries cannot be detected
Solution Approach 1:
The patent implements a universal scanning mechanism using finite automata that can detect multiple types of malicious patterns across different packet boundaries. The same scanning infrastructure handles both control information inspection and payload data analysis, providing adaptable detection capability while maintaining network security.
Solution Approach 2:
The system introduces finite automata as an intermediary processing layer between packet reception and security decision-making. This intermediary enables comprehensive inspection of payload data including cross-boundary malicious code segments, enhancing detection capability without compromising the existing firewall security framework.
3Measurement precision
If regular expressions are used to identify unwanted patterns in data units, then detection accuracy is improved, but processing complexity increases
Solution Approach 1:
The patent replaces complex regular expression processing with finite automata state machines. This substitution maintains high detection accuracy for identifying unwanted patterns while significantly reducing processing complexity. The finite automata provide a more efficient computational model for pattern matching in network security applications.
Data Source
AI summary
A method and system for ensuring system security is disclosed. The method and system utilize a first processing unit to split a regular expression that corresponds to a number of patterns into sub-expressions and maintain the dependency relationships among the finite automata that correspond to the sub-expressions. Then, the method and system utilize a second processing unit to move the data units through these finite automata in a sequence that is based on the dependency relationships to identify the suspected data units. The suspected data units are the ones containing content that collectively matches one or more of the aforementioned patterns. Identification of the suspected data units is based on the merged results of the finite automata.