System security approaches utilizing a hierarchical memory system

• US 7,779,464 B2
• Filed: 01/24/2006
• Issued: 08/17/2010
• Est. Priority Date: 06/14/2004
• Status: Active Grant

• Current Assignee: Lionic Corp.
• Original Assignee: Lionic Corp.
• Inventors: Chen, Meng-Hong, Zhao, Shi-Ming, Chien, Shih-Wei
• Primary Examiner(s): Song; Hosuk
• Application Number:
  US11/307,105
• Publication Number:
  US 20060224828A1
• Time in Patent Office: 1,666 Days
• Field of Search: 711/117, 711/100, 711/105, 711111-112, 711/122, 726/1, 726 22- 26, 726/11, 713165-166, 713187-188
• US Class Current: 726/22
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 13/28 using burst mode transfer, e.g. direct memory access DMA, cycle steal G06F13/32 takes precedence
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 2201/83 the solution involving signatures
• CPC Class Codes: G06F 2201/875 Monitoring of systems including the internet
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method and system for ensuring system security is disclosed. Based on the content of the data units the method and system monitor, the method and system retrieve the states and the dependency relationships among these states that are representative of unwanted patterns. The method and system store the states and the dependency relationships mentioned above in different types of memories according to the frequency of accessing the states. The frequency is calculated by comparing a number of test data patterns with the states in a sequence specified by the dependency relationships. The method and system further identify a set of suspected data units by comparing the data units with the retrieved states in a sequence specified by the retrieved dependency relationships, wherein the content of the set of the suspected data units collectively matches any of the unwanted patterns.

Claims

1. A method for monitoring a plurality of data units, comprising:

based on the content of said plurality of said data units, retrieving a plurality of states and dependency relationships among said plurality of said states that correspond to a plurality of unwanted patterns from a hierarchical memory system, wherein

said plurality of said states and said dependency relationships are placed in a plurality of memory types in said hierarchical memory system according to a frequency of accessing said plurality of said states, which is calculated by comparing a plurality of test data patterns with said plurality of said states in a sequence specified by said dependency relationships; and

identifying a set of suspected data units by comparing said plurality of said data units with said plurality of said states in said sequence specified by said dependency relationships, wherein the content of said set of said suspected data units collectively matches any of said plurality of said unwanted patterns.

2. The method as recited in claim 1, further comprising:

selecting from said plurality of said memory types at least one memory tier with a plurality of corresponding virtual addresses to store said plurality of said states and said dependency relationships.

3. The method as recited in claim 2, further comprising:

mapping said plurality of said corresponding virtual addresses to a plurality of physical memory addresses; and

retrieving said plurality of said states and said dependency relationships from said plurality of said physical memory addresses.

4. The method as recited in claim 1, further comprising:

decompressing said plurality of said states and said dependency relationships, which are retrieved from said plurality of said memory types and have been compressed, prior to identifying said set of said suspected data units.

5. The method as recited in claim 4, further comprising:

selecting a decompression method based on the content of said plurality of said data units.

6. The method as recited in claim 1, wherein each of said plurality of said memory types in said hierarchical memory system has a distinctive memory access time.

7. The method as recited in claim 1, wherein each of said plurality of said data units contains at least one processing element.

8. A system for monitoring a plurality of data units, comprising:

a dispatch means for, based on the content of said plurality of said data units, retrieving a plurality of states and dependency relationships among said plurality of said states that correspond to a plurality of unwanted patterns from a hierarchical memory system, wherein

said plurality of said states and said dependency relationships are placed in a plurality of memory types in said hierarchical memory system according to a frequency of accessing said plurality of said states, which is calculated by comparing a plurality of test data patterns with said plurality of said states in a sequence specified by said dependency relationships; and

a content inspection means for identifying a set of suspected data units by comparing said plurality of said data units with said plurality of said states in said sequence specified by said dependency relationships, wherein the content of said set of said suspected data units collectively matches any of said plurality of said unwanted patterns.

9. The system as recited in claim 8, further comprising:

means for selecting from said plurality of said memory types at least one memory tier with a plurality of corresponding virtual addresses to store said plurality of said states and said dependency relationships.

10. The system as recited in claim 9, further comprising:

means for mapping said plurality of said corresponding virtual addresses to a plurality of physical memory addresses; and

means for retrieving said plurality of said states and said dependency relationships from said plurality of said physical memory addresses.

11. The system as recited in claim 8, further comprising:

means for decompressing said plurality of said states and said dependency relationships, which are retrieved from said plurality of said memory types and have been compressed, prior to identifying said set of said suspected data units.

12. The system as recited in claim 11, wherein said dispatch means further selects a decompression method based on the content of said plurality of said data units.

13. The system as recited in claim 8, wherein each of said plurality of said memory types in said hierarchical memory system has a distinctive memory access time.

14. The system as recited in claim 8, wherein each of said plurality of said data units contains at least one processing element, which is supported by said content inspection means.

15. A system for monitoring a plurality of data units, comprising:

a dispatch engine;

a hierarchical memory system;

a content inspection engine, coupled to said distribution engine and said hierarchical memory system, wherein;

said dispatch engine, based on the content of said plurality of said data units, retrieves a plurality of states and dependency relationships among said plurality of said states that correspond to a plurality of unwanted

patterns from said hierarchical memory system, wherein said dispatch engine has caused the distribution of said plurality of said states and said dependency relationships among a plurality of memory types in said hierarchical memory system according to a frequency of accessing said plurality of said states calculated by an application, which compares a plurality of test data patterns with said plurality of said states in a sequence specified by said dependency relationships; and

said content inspection engine identifies a set of suspected data units by comparing said plurality of said data units with said plurality of said states in said sequence specified by said dependency relationships, wherein the content of said set of said suspected data units collectively matches any of said plurality of said unwanted patterns.

16. The system as recited in claim 15, wherein said dispatch engine further comprising:

a partition controller to select from said plurality of said memory types at least one memory tier with a plurality of corresponding virtual addresses to store said plurality of said states and said dependency relationships.

17. The system as recited in claim 16, wherein said partition controller maps said plurality of said corresponding virtual addresses to a plurality of physical memory addresses.

18. The system as recited in claim 15, wherein said dispatch engine further comprising:

a plurality of decompression engines that decompress said plurality of said states and said dependency relationships, which are retrieved from said plurality of said memory types and have been compressed, prior to identifying said set of said suspected data units.

19. The system as recited in claim 18, wherein said dispatch engine further:

selects a decompression method based on the content of said plurality of said data units.

20. The system as recited in claim 15, wherein each of said plurality of said memory types in said hierarchical memory system has a distinctive memory access time.

21. The system as recited in claim 15, wherein each of said plurality of said data units contains at least one processing element, which is supported by said content inspection engine.

22. A system for monitoring a plurality of data units, comprising:

a bus;

a processor, coupled to said bus;

a hierarchical memory system, coupled to said bus; and

a content inspection co-processor coupled to said bus and to said hierarchical memory system, wherein said content inspection co-processor further comprising;

a dispatch engine;

a content inspection engine, coupled to said distribution engine, wherein;

said dispatch engine, based on the content of said plurality of said data units, retrieves a plurality of states and dependency relationships among said plurality of said states from said hierarchical memory system, which collectively represent a plurality of unwanted patterns, wherein

said plurality of said states and said dependency relationships were distributed among a plurality of memory types in said hierarchical memory system by said dispatch engine according to a frequency of accessing said plurality of said states calculated by an application, which when executed upon said processor, compares a plurality of test data patterns with said plurality of said states in a sequence specified by said dependency relationships;

and

said content inspection engine identifies a set of suspected data units by comparing said plurality of said data units with said plurality of said states in said sequence specified by said dependency relationships, wherein the content of said set of said suspected data units collectively matches any of said plurality of said unwanted patterns.

23. The system as recited in claim 22, wherein said dispatch engine further comprising:

a partition controller to select from said plurality of said memory types at least one memory tier with a plurality of corresponding virtual addresses to store said plurality of said states and said dependency relationships are stored.

24. The system as recited in claim 23, wherein said partition controller maps said plurality of said corresponding virtual addresses to a plurality of physical memory addresses.

25. The system as recited in claim 22, wherein said dispatch engine further comprising:

a plurality of decompression engines that decompress said plurality of said states and said dependency relationships, which are retrieved from said plurality of said memory types and have been compressed, prior to identifying said set of said suspected data units.

26. The system as recited in claim 25, wherein said dispatch engine further selects a decompression method based on the content of said plurality of said data units.

27. The system as recited in claim 22, wherein each of said plurality of said memory types in said hierarchical memory system has a distinctive memory access time.

28. The system as recited in claim 22, wherein each of said plurality of said data units contains at least one processing element, which is supported by said content inspection co-processor.