Intrusion detection signature analysis using regular expressions and logical operators

• US 6,487,666 B1
• Filed: 01/15/1999
• Issued: 11/26/2002
• Est. Priority Date: 01/15/1999
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Lathem, Gerald S., Shanklin, Steven D., Bernhard, Thomas E.
• Primary Examiner(s): Hayes, Gail
• Assistant Examiner(s): Revak, Christopher A.
• Application Number:
  US09/232,385
• Time in Patent Office: 1,411 Days
• Field of Search: 709/223, 709/224, 713/168, 713/176, 713/177, 713/178, 713/187, 713/188, 713/200, 713/201
• US Class Current: 726/23
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A method of describing intrusion signatures, which are used by an intrusion detection system to detect attacks on a local network. The signatures are described using a “high level” syntax having features in common with regular expression and logical expression methodology. These high level signatures may then be compiled, or otherwise analyzed, to provide a process executable by a sensor or other processor-based signature detector.

Claims

1. A packet-based method embodied in a computer-readable medium, of describing signatures used for detecting intrusion to a local network, comprising the steps of:

using a set of regular expression identifiers to represent a set of packet types;

using logical operators to describe relationships between said packet types;

combining said at least one of said identifiers and at least one of said logical operators to provide a regular expression describing each of said signatures; and

using said regular expressions to provide an executable process.

2. The method of claim 1, further comprising the step of transforming said regular expression to a decision tree.

3. The method of claim 1, further comprising the step of storing said process in memory accessible by an intrusion detection processor.

4. An event-based method embodied in a computer-readable medium, of describing signatures used for detecting intrusion to a local network, comprising the steps of:

using a first set of regular expression identifiers to represent a set of packet types;

using a second set of regular expression identifiers to represent a set of packet sequences;

using a third set of regular expression identifiers to represent a set of signature-related events;

for each signature, selecting at least one of said identifiers to provide a regular expression describing that signatures; and

using said regular expressions to provide an executable process.

5. The method of claim 4, further comprising the step of transforming said regular expression to a decision tree.

6. The method of claim 4, further comprising the step of storing said process in memory accessible by an intrusion detection processor.

7. An event-based method embodied in a computer-readable medium, of describing signatures used for detecting intrusion to a local network, comprising the steps of:

using a set of regular expression identifiers to represent a set of signature events;

using logical operators to describe relationships between said signature events;

combining said identifiers and said logical operators to provide a regular expression describing said signatures; and

using said regular expressions to provide an executable process.

8. The method of claim 7, wherein at least one of said identifiers represents a packet type.

9. The method of claim 7, wherein at least one of said identifiers represents a sequence of packets.

10. The method of claim 7, wherein at least one of said identifiers represents a signature-related event.

11. The method of claim 7, further comprising the step of transforming said regular expression to a decision tree.

12. The method of claim 7, further comprising the step of storing said process in memory accessible by an intrusion detection processor.