Apparatus and method for efficient data pre-filtering in a data stream

• US 20070179935A1
• Filed: 01/31/2006
• Published: 08/02/2007
• Est. Priority Date: 01/31/2006
• Status: Abandoned Application

• Current Assignee: Reti Corp.
• Original Assignee: Reti Corp.
• Inventors: Wu, Jo-Yu, Lee, Tsern-Huei
• Application Number:
  US11/344,302
• Publication Number:
  US 20070179935A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/24568 Data stream processing; Continuous queries
• CPC Class Codes: G06F 16/90344 by using string matching techniques
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

An apparatus and method for enabling rapid transfer of safe data in a data communication network. The apparatus includes a plurality of query modules, a search window, a shift detector, and a database of unsafe data. A predetermined portion of the unsafe data'"'"'s signature is populated into the query modules, and the signature of a received data in the search window is compared against a plurality of query modules. The search window is shifted according to the result of comparison with the plurality of query modules detected by the shift detector.

Claims

1. A method for a computing device to identify undesirable data in a data stream, wherein the data stream is received from a network and may contain undesirable data, the computing device having a plurality of undesirable data, comprising the steps of:

creating a database of undesirable data;

populating a plurality of query modules with the undesirable data from the database;

receiving a data stream;

loading a search window with data from the data stream;

comparing the search window with the plurality of query modules; and

if a first comparison result indicates no shifting, identifying the data stream as undesirable data.

2. The method of claim 1, further comprising the step of shifting the search window to a first direction according to the first comparison result.

3. The method of claim 2, further comprising the step of loading the search window according to the first comparison result.

4. The method of claim 3, further comprising the steps of, if shifting is less than predetermined positions, moving some data in the search window to new positions within the search window according to the first comparison result.

5. The method of claim 1, further comprising the step of defining a width for the search window.

6. The method of claim 1, wherein the step of creating a database of undesirable data further comprising the step of storing corresponding bits of undesirable data in contiguous memory locations.

7. The method of claim 1, wherein the step of identifying the data stream as undesirable data further comprising steps for:

shifting the search window to a second direction;

comparing the data stream through the search window with the plurality of query modules; and

if a second comparison result indicates no shifting, identifying the data stream as undesirable data.

8. The method of claim 7, further comprising the step of, if the second comparison result indicates shifting, shifting the search window to the first direction according to the second comparison result.

9. The method of claim 1, wherein the step of identifying the data stream as undesirable data further comprising steps for:

comparing the search window with a second plurality of query modules, wherein each query module in the second plurality of query modules being populated with data from a second database; and

if a third comparison result indicates no shifting, identifying the data stream as undesirable data.

10. An apparatus for identifying unsafe data in a data stream, wherein the data stream is received from a network, each unsafe datum being identified by a unique data signature, comprising:

a data receiver for receiving a data stream from a data source;

a search window for loading data from the data stream;

a plurality of query modules, each query module being populated with unsafe data and capable of comparing the data with the data in the search window; and

a shift detector for receiving results from the plurality of query modules,

wherein if the shift detector indicates no shifting, the data stream is classified as unsafe data.

11. The apparatus of claim 10, further comprising a query module that always returning a positive result.

12. The apparatus of claim 10, further comprising a database of unsafe data.

13. The apparatus of claim 10, further comprising a content search engine for analyzing the data that is classified as unsafe data.

14. The apparatus of claim 10, further comprising a data processing unit for processing safe data.

15. The apparatus of claim 10, further comprising a master bitmap.

16. The apparatus of claim 10, further comprising a bitwise AND operator for ANDing the results from the plurality of query modules with a content from the master bitmap.

17. A computer-readable medium on which is stored a computer program for a computing device to identify undesirable data in a data stream, wherein the data stream is received from a network and may contain undesirable data, each undesirable datum being identified by a unique data signature and the computing device having a plurality of undesirable data signatures identifying undesirable data, the computer program comprising computer instructions that when executed by a computing device performs the steps for:

creating a database of undesirable data;

populating a plurality of query modules with the undesirable data from the database;

receiving the data stream;

loading a search window with data from the data stream;

comparing the search window with the plurality of query modules; and

if a first comparison result indicates no shifting, identifying the data stream as undesirable data.

18. The computer program of claim 17, further performing the step of shifting the search window to a first direction according to the first comparison result.

19. The computer program of claim 18, further performing the step of loading the search window according to the first comparison result.

20. The computer program of claim 19, further performing the steps of, if shifting is fewer than a predetermined positions, moving some data in the search window to new positions within the search window according to the first comparison result.

21. The computer program of claim 17, further performing the step of defining a width for the search window.

22. The computer program of claim 17, wherein the step of creating a database of undesirable data further comprising the step of storing corresponding bits of undesirable data in contiguous memory locations.

23. The computer program of claim 17, wherein the step of identifying the data stream as undesirable data further comprising steps for:

shifting the search window to a second direction;

comparing the data stream through the search window with the plurality of query modules; and

if a second comparison result indicates no shifting, identifying the data stream as undesirable data.

24. The computer program of claim 23, further comprising the step of, if the second comparison result indicates shifting, shifting the search window to the first direction according to the second comparison result.

25. A method for a computing device to identify undesirable data in a data stream, wherein the data stream is received from a network and may contain undesirable data, the computing device having a plurality of undesirable data, comprising the steps of:

creating a database of undesirable data;

populating a plurality of query modules with the undesirable data from the database;

receiving the data stream;

loading a search window with data from the data stream;

comparing the search window with the plurality of query modules;

ANDing a first comparison result with a master bitmap; and

if an ANDing result indicates no shifting, identifying the data stream as undesirable data.

26. The method of claim 25, further comprising the step of shifting the search window to a first direction according to the ANDing result.

27. The method of claim 26, further comprising the step of loading the search window according to the ANDing result.

28. The method of claim 27, further comprising the steps of, if shifting is less than predetermined positions, moving some data in the search window to new positions within the search window according to the ANDing result.

29. The method of claim 25, further comprising the step of defining a width for the search window.

30. The method of claim 25, wherein the step of creating a database of undesirable data further comprising the step of storing corresponding bits of undesirable data in contiguous memory locations.

31. The method of claim 25, wherein the step of identifying the data stream as undesirable data further comprising steps for:

comparing the search window with a second plurality of query modules, wherein each query module in the second plurality of query modules being populated with data from a second database; and

if a third comparison result indicates no shifting, identifying the data stream as undesirable data.