UTM Sub-Contexts for SPDY Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The SPDY protocol's multiplexing of data streams into a single TCP connection poses a challenge for unified threat management (UTM) devices, as they struggle to analyze data packets in sequential order, leading to potential malware being undetected and passed through to clients.
Innovation Solution
An improved UTM device generates sub-contexts for each data stream, allowing for the reassembly and analysis of data packets to detect malware, using incremental hash computations and a signature database to identify malicious content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data streams are multiplexed into a single TCP connection using SPDY protocol, then transmission efficiency is improved, but malware detection capability deteriorates
Solution Approach 1:
The patent segments the multiplexed data stream by creating separate sub-contexts for each logical data stream. Each sub-context maintains independent state information (stream IDs, sequence numbers, window sizes) allowing the UTM device to track and analyze packets from different logical streams separately, even though they traverse a single physical TCP connection. This segmentation enables reliable malware detection while preserving SPDY's multiplexing efficiency.
2Ease of operation
If data packets are analyzed in sequential order, then analysis simplicity is improved, but detection accuracy deteriorates
Solution Approach 1:
The patent introduces sub-contexts as intermediary data structures between the multiplexed data stream and the analysis engine. Each sub-context acts as a buffer that reassembles packets for a specific logical stream in the correct sequence, maintaining state information needed for accurate detection. This intermediary layer preserves analysis simplicity while achieving detection accuracy by ensuring packets are processed in their proper logical order.
3Productivity
If multiple concurrent streams are multiplexed into single connection, then bandwidth utilization is improved, but packet tracking complexity increases
Solution Approach 1:
The patent applies local quality by creating specialized sub-contexts with specific tracking capabilities tailored to each logical data stream. Each sub-context maintains only the state information relevant to its associated stream (stream ID, sequence numbers, window size), rather than tracking all streams globally. This localized approach manages complexity by distributing tracking responsibilities across multiple simple, specialized structures rather than one complex global structure.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In example implementations, a method is provided that is executed by a processor. A multiplexed data stream is received over a single transmission control protocol (TCP) connection that uses a SPDY protocol. The multiplexed data stream contains data packets associated with a plurality of different data streams. A plurality of sub-contexts are generated. Each one of the sub-contexts is associated with a different one of the plurality of different data streams. The data packets are demultiplexed from the multiplexed data stream into a respective one of the plurality of sub-contexts. The plurality of different data streams in the respective one of the plurality of sub-contexts are examined to detect a malware.