Dynamic depth inspection

• US 7,836,499 B1
• Filed: 11/18/2004
• Issued: 11/16/2010
• Est. Priority Date: 11/18/2004
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Bennett, Jeremy, Hernacki, Brian
• Primary Examiner(s): Vu; Kimyen
• Assistant Examiner(s): To; Baotran N
• Application Number:
  US10/994,171
• Time in Patent Office: 2,189 Days
• Field of Search: 726 22- 25, 713/188, 709/224, 709/226
• US Class Current: 726/22
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Detecting network threats through dynamic depth inspection is disclosed. A mandatory threat detection procedure is performed on data received via a network. It is determined probabilistically whether to perform an optional threat detection procedure on at least a portion of the data. The optional threat detection procedure is then performed if it is determined that it should be performed.

Claims

1. A method for detecting network threats comprising:

performing, using at least one processor, a mandatory threat detection procedure on data received via a network;

determining whether to perform at least one of a plurality of optional threat detection procedures on at least a portion of the data, the determination based at least in part on;

resources required for the mandatory threat detection procedure, wherein remaining resources are allocated to the plurality of optional threat detection procedures;

a frequency at which each of the plurality of optional threat detection procedures should be performed; and

a selection criterion that is established to determine probabilistically whether at least one of the plurality of optional threat detection procedures will be performed with respect to a particular set of data; and

performing one or more of the at least one of the plurality of optional threat detection procedures if determined that the one or more of the at least one of the plurality of optional threat detection procedures should be performed.

2. The method recited in claim 1 wherein determining whether to perform at least one of the plurality of optional threat detection procedures is further based at least in part on resources required for mandatory threat detection processing.

3. The method recited in claim 1 further comprising determining what processing resources are available to perform at least one of the plurality of optional threat detection procedures and establishing a selection criterion to be used to determine whether at least one of the plurality of optional threat detection procedures will be applied to a particular set of data and wherein determining whether to perform at least one of the plurality of optional threat detection procedures includes applying the selection criterion to the data.

4. The method recited in claim 3 wherein determining what processing resources are available to perform at least one of the plurality of optional threat detection procedures includes allocating to each of the plurality of optional threat detection procedures a portion of a total amount of resources determined to be available to perform optional threat detection procedures.

5. The method recited in claim 1 wherein a criterion used to determine whether at least one of the plurality of optional threat detection procedures should be performed is determined dynamically.

6. The method recited in claim 1 wherein a criterion used to determine whether at least one of the plurality of optional threat detection procedures should be performed is determined dynamically based at least in part on a dynamic determination of the resources available to perform optional threat detection procedures.

7. The method recited in claim 1 wherein a criterion used to determine whether at least one of the plurality of optional threat detection procedures should be performed is determined dynamically based at least in part on a user input.

8. The method recited in claim 1 wherein a criterion used to determine whether at least one of the plurality of optional threat detection procedures should be performed is determined dynamically based at least in part on a dynamic assessment of network traffic load.

9. The method recited in claim 1 further comprising updating a criterion used to determine whether at least one of the plurality of optional threat detection procedures should be performed.

10. The method recited in claim 1 further comprising updating at a prescribed interval a criterion used to determine whether at least one of the plurality of optional threat detection procedures should be performed.

11. The method recited in claim 1 wherein determining whether at least one of the plurality of optional threat detection procedures should be performed includes determining whether the data includes a portion on which threat detection processing is not performed in all cases.

12. The method recited in claim 1 wherein determining whether at least one of the plurality of optional threat detection procedures should be performed includes whether any signatures or rules exist that could be applied to the data.

13. The method recited in claim 1 wherein determining whether at least one of the plurality of optional threat detection procedures should be performed includes determining whether any signatures or rules exist that could be applied to at least a portion of the data on which threat detection processing is not performed in all cases.

14. The method recited in claim 1 further comprising determining probabilistically for each of the plurality of optional threat detection procedures whether at least one of the plurality of optional threat detection procedures should be performed on a particular set of received data.

15. The method recited in claim 14 wherein determining probabilistically for each of the plurality of optional threat detection procedures whether at least one of the plurality of optional threat detection procedures should be performed on a particular set of received data comprises applying to the set of received data a selection criterion associated with at least one of the plurality of optional threat detection procedures.

16. A system for detecting network threats comprising:

a communication interface configured to receive data received via a network; and

a processor configured to;

perform a mandatory threat detection procedure on the data;

determining whether to perform at least one of a plurality of optional threat detection procedures on at least a portion of the data, the determination based at least in part on;

resources required for the mandatory threat detection procedure, wherein remaining resources are allocated to the plurality of optional threat detection procedures;

a frequency at which each of the plurality of optional threat detection procedures should be performed; and

a selection criterion that is established to determine probabilistically whether at least one of the plurality of optional threat detection procedures will be performed with respect to a particular set of data; and

performing one or more of the at least one of the plurality of optional threat detection procedures if determined that the one or more of the at least one of the plurality of optional threat detection procedures should be performed.

17. A computer program product for detecting network threats, the computer program product being embodied in a computer readable storage medium and comprising computer instructions for:

performing a mandatory threat detection procedure on data received via a network;

determining whether to perform at least one of a plurality of optional threat detection procedures on at least a portion of the data, the determination based at least in part on;

resources required for the mandatory threat detection procedure, wherein remaining resources are allocated to the plurality of optional threat detection procedures;

a frequency at which each of the plurality of optional threat detection procedures should be performed; and

a selection criterion that is established to determine probabilistically whether at least one of the plurality of optional threat detection procedures will be performed with respect to a particular set of data; and

performing one or more of the at least one of the plurality of optional threat detection procedures if determined that the one or more of the at least one of the plurality of optional threat detection procedures should be performed.