Sub-expression Automata for Cross-Packet Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security approaches, such as firewalls and anti-virus programs, fail to effectively inspect payload data or handle malicious code segments that span across packet boundaries, particularly for real-time protocols, rendering them inoperable for timely attack detection.
Innovation Solution
The system employs deterministic finite automata and regular expressions to split patterns into sub-expressions, manage state transitions, and compare data units against these patterns, allowing for real-time identification and action on suspected malicious code segments across packet boundaries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If packets are assembled into complete files before scanning for virus patterns, then detection accuracy improves, but real-time protocol responsiveness deteriorates
Solution Approach 1:
The patent segments the file assembly process into packet-level units and processes each packet independently through the finite automaton. Instead of waiting for complete file assembly, the system divides the inspection task into smaller sub-tasks that can be executed on individual packets or packet segments, enabling real-time processing while maintaining detection capability across packet boundaries.
Solution Approach 2:
The system performs preliminary actions by pre-compiling virus patterns into finite automaton state machines before runtime. This preliminary compilation allows the system to immediately begin pattern matching on incoming packets without waiting for file assembly, achieving both real-time responsiveness and accurate detection through pre-prepared detection mechanisms.
2Reliability
If payload data and malicious code segments spanning packet boundaries are inspected, then detection capability improves, but processing complexity increases
Solution Approach 1:
The patent introduces finite automata as an intermediary mechanism between incoming packets and virus pattern matching. The automaton serves as a mediator that maintains state information across packet boundaries, allowing the system to inspect code segments that span multiple packets without directly managing the complexity of cross-packet correlation. This intermediary abstraction simplifies the processing of distributed malicious code.
Solution Approach 2:
The system replaces traditional mechanical file-assembly-based scanning with a state-machine-based approach. Instead of physically assembling files from packets and then scanning, the finite automaton substitutes this mechanical process with a computational state transition system that naturally handles cross-packet pattern matching through its memory and transition capabilities, reducing processing complexity.
3Ease of operation
If traditional firewall and anti-virus techniques are used, then implementation simplicity is maintained, but inspection of payload data and cross-packet malicious code is ineffective
Solution Approach 1:
The patent makes the finite automaton a universal inspection mechanism that can detect multiple types of threats including payload data anomalies and cross-packet malicious code segments. This single multi-functional approach replaces the need for separate specialized systems, maintaining implementation simplicity while significantly improving inspection effectiveness across different attack vectors.
Data Source
AI summary
A method and system for ensuring system security is disclosed. The method and system split a regular expression that corresponds to a number of patterns into sub-expressions. The dependency relationships among the finite automata that correspond to the sub-expressions are maintained. Then, as data units are put through these finite automata in a sequence that is based on the dependency relationships, suspected data units are identified. The suspected data units are the ones containing content that collectively matches one or more of the aforementioned patterns. Identification of the suspected data units is based on the merged results of the finite automata. Depending on the result of identifying the suspected data units, different actions are performed.