×

NETWORK ATTACK DETECTION USING PARTIAL DETERMINISTIC FINITE AUTOMATON PATTERN MATCHING

  • US 20080263665A1
  • Filed: 04/20/2007
  • Published: 10/23/2008
  • Est. Priority Date: 04/20/2007
  • Status: Active Grant
First Claim
Patent Images

1. A method comprising:

  • storing a set of full deterministic finite automaton (fDFA) nodes, wherein the fDFA nodes represent a full deterministic finite automaton fDFA that accepts symbol streams that conform to a symbol pattern;

    creating a set of pDFA nodes, wherein the pDFA nodes represent a partial deterministic finite automaton (pDFA),wherein each of the pDFA nodes has a corresponding node in the fDFA nodes that has a visitation level that exceeds a visitation threshold,wherein each node in the pDFA nodes specifies a transition for a symbol to a node in the pDFA nodes when the corresponding node in the fDFA nodes specifies a transition for the symbol to a node in the fDFA nodes that has a visitation level that exceeds the visitation threshold, andwherein each node in the pDFA nodes specifies a transition for a symbol to a failure node in the pDFA nodes when the corresponding node in the fDFA nodes specifies a transition for the symbol to a node in the fDFA nodes that has a visitation level that does not exceed the visitation threshold;

    receiving a symbol in a symbol stream;

    determining whether a current node of the pDFA nodes is a failure node;

    determining, when the current node of the pDFA nodes is not the failure node, whether the current node of the pDFA nodes specifies a transition for the symbol to the failure node;

    identifying, when the current node of the pDFA nodes specifies a transition for the symbol to the failure node, a node in the fDFA nodes that corresponds to the current node of the pDFA nodes as a current node of the fDFA nodes; and

    detecting a computer security threat when the current node of the pDFA nodes is the failure node and when the current node of the fDFA nodes specifies a transition for the symbol to an accepting node.

View all claims
  • 1 Assignment
Timeline View
Assignment View
    ×
    ×