Methods and systems for intrusion detection

Details Methods and systems for intrusion detection Methods and systems for intrusion detection

2007-12-04

2007-12-04

Moazzami, Nasser (Department: 2136)

Information security

Monitoring or scanning of software or data including attack...

Intrusion detection

C726S022000, C713S151000

Reexamination Certificate

active

10793887

ABSTRACT:
Performance of an intrusion detection system is enhanced with the addition of rule optimization, set-based rule inspection, and protocol flow analysis. During rule optimization, rule sets are created and selected in such a way that for every incoming packet only a single rule set has to be searched. Set-based rule inspection divides rules into content and non-content type rules. Only search patterns of content type rules are initially compared to a packet. Rules containing matched search patterns are validated with a parameterized search against the packet. Matches are recorded as events. Non-content rules are searched against a packet using a parameterized search. These matches are also recorded as an event. At least one event is selected per packet for logging. Protocol flow analysis determines the direction of flow of network traffic. Based on the direction of flow and the protocol, portions of packets can be eliminated from rule inspection.

REFERENCES:
patent: 5796942 (1998-08-01), Esbensen
patent: 6219786 (2001-04-01), Cunningham et al.
patent: 6321338 (2001-11-01), Porras et al.
patent: 6324656 (2001-11-01), Gleichauf et al.
patent: 6499107 (2002-12-01), Gleichauf et al.
“SNORT—Lightweight Intrusion Detection For Networks,” Martin Roesch, USENIX, Proceedings of LISA '99 Systems Administration Conference, Nov. 12, 1999.
“Writing SNORT Rules,” Martin Roesch, 1999.

Affiliated with

Also associated with

Rating

Methods and systems for intrusion detection does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Methods and systems for intrusion detection, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Methods and systems for intrusion detection will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-3896445