Programmable context aware firewall with integrated intrusion detection system
First Claim
1. A method comprising:
- receiving at least one protocol state machine definition for a network protocol, said protocol state machine definition including a plurality of protocol state rules;
parsing the at least one protocol state machine definition to form a set of parsed protocol state rules, said parsed protocol state rules including at least one condition and at least one action associated with the condition;
storing a set of filters in a filter database;
receiving a network flow, said flow including a plurality of packets; and
applying the parsed protocol state rules to the plurality of packets in the network flow;
wherein the at least one action comprises the instantiation of a filter from the set of filters.
1 Assignment
0 Petitions
Accused Products
Abstract
A context-aware firewall and intrusion detection system receives a definition of a Protocol State Machine (PSM) that defines the expected behavior of any protocol (FTP, HTTP, etc.). The PSM provides rules for detecting flows that deviate from the defined protocol behavior and taking appropriate actions. PSMs are comprised of rule groups define behavior of a protocol. The rules include conditions and actions that may be executed if the conditions are satisfied, The actions include dynamically adding filters to be applied to the network flow, saving results for use in later executed rules, and activating and deactivating rules. Thus, these firewalls are capable of selective and intelligent Processing based on flow state information and control payload.
-
Citations
25 Claims
-
1. A method comprising:
-
receiving at least one protocol state machine definition for a network protocol, said protocol state machine definition including a plurality of protocol state rules;
parsing the at least one protocol state machine definition to form a set of parsed protocol state rules, said parsed protocol state rules including at least one condition and at least one action associated with the condition;
storing a set of filters in a filter database;
receiving a network flow, said flow including a plurality of packets; and
applying the parsed protocol state rules to the plurality of packets in the network flow;
wherein the at least one action comprises the instantiation of a filter from the set of filters. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 15)
-
-
9. A system comprising:
-
a parser operable to parse at least one protocol state machine definition for a network protocol to a set of parsed protocol state rules, said protocol state machine definition including a plurality of protocol state rules, said parsed protocol state rules including at least one condition and at least one action associated with the condition;
a filter database operable to store a set of filters in a filter database; and
a protocol analysis engine operable to receive a network flow, said flow including a plurality of packets; and
apply the parsed protocol state rules to the plurality of packets in the network flow;
wherein the at least one action comprises the instantiation of a filter from the set of filters. - View Dependent Claims (10, 11, 12, 13, 14, 16, 17)
-
-
18. A machine readable medium having machine executable instructions for performing a method comprising:
-
receiving at least one protocol state machine definition for a network protocol, said protocol state machine definition including a plurality of protocol state rules;
parsing the at least one protocol state machine definition to form a set of parsed protocol state rules, said parsed protocol state rules including at least one condition and at least one action associated with the condition;
storing a set of filters in a filter database;
receiving a network flow, said flow including a plurality of packets; and
applying the parsed protocol state rules to the plurality of packets in the network flow;
wherein the at least one action comprises the instantiation of a filter from the set of filters. - View Dependent Claims (19, 20, 21, 22, 23, 24, 25)
-
Specification