Kernel Packet Capture via Virtual File Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network devices lack the capability to capture, analyze, and store all data communicated through a network for monitoring policy violations and detecting information leaks, especially in preventing unauthorized data transmission from entering or leaving the network.
Innovation Solution
A comprehensive system that intercepts and reconstructs data packets, uses an object assembly module to reassemble documents, and an object classification module to classify and store relevant data based on capture rules, with a packet capture module and network interface module to handle high-speed data capture and processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional network devices are used for packet capture, then device complexity is reduced, but the capability to capture, analyze, and store all network data is insufficient
Solution Approach 1:
The system divides network data capture and processing into distinct functional modules: a network interface module for receiving packets, a packet capture module for intercepting and copying packets, and an object assembly module for reassembling documents. This segmentation allows each module to specialize in specific tasks, enhancing overall capability while managing complexity through modular design.
Solution Approach 2:
The patent introduces a dedicated packet capture module as an intermediary component between the network interface and higher-level processing systems. This intermediary intercepts packets at the network layer, creates copies for analysis, and forwards original packets to their destinations, thereby enhancing monitoring capability without disrupting normal network traffic flow.
2Measurement precision
If high-speed packet capture is implemented to monitor all network data, then detection capability is improved, but processing speed may be compromised due to the volume of data
Solution Approach 1:
The system extracts only the necessary packet copies for analysis while leaving the original packet flow intact. The packet capture module creates selective copies of packets for monitoring purposes, separating the analysis function from the main data transmission path. This extraction approach enables comprehensive detection without requiring the entire network infrastructure to process every byte of traffic.
Solution Approach 2:
The patent implements partial action by capturing and analyzing only the portions of network traffic that require monitoring, rather than processing every packet in full detail. The object assembly module selectively reassembles documents from captured packets based on monitoring requirements, enabling efficient detection of policy violations and information leaks without the overhead of complete packet processing.
3Loss of information
If all network data is captured and stored for analysis, then information security monitoring is improved, but data storage requirements increase
Solution Approach 1:
The system performs preliminary actions by capturing and assembling network data in real-time as it flows through the network. The object assembly module continuously reassembles documents from captured packets, maintaining an up-to-date view of network communications without requiring bulk storage of all historical traffic. This preliminary processing enables immediate detection of security events while reducing long-term storage requirements.
Data Source
AI summary
Packets can be read from a network interface into an application using a single kernel copy. In one embodiment, the invention includes a receiver packet memory to store captured packets, and a network interface driver operating in a kernel of a device to read packets captured by network interface hardware into the kernel by storing captured packets in the receiver packet memory. Then, an application interface can expose the receiver packet memory to an application executing on the device by representing the receiver packet memory as a virtual file.