Scaled scanning parameterization

• US 7,930,739 B1
• Filed: 05/24/2005
• Issued: 04/19/2011
• Est. Priority Date: 05/24/2005
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Nachenberg, Carey
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US11/136,098
• Time in Patent Office: 2,156 Days
• Field of Search: 726/22, 726/23, 726/25, 726/11
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Evaluating a data transmission is disclosed. In various embodiments evaluating the data transmission may include transforming a parameter associated with the data transmission into an augmented parameter wherein the augmented parameter represents a plurality of binned parameters. The augmented parameter is matched to a scaled parameterized rule set wherein the scaled parameterized rule set references the augmented parameter. The scaled parameterized rule set is applied to the data transmission.

Claims

1. A method of evaluating an electronic data transmission comprising:

transforming, using an electronic processor, a parameter associated with the electronic data transmission into an augmented parameter, wherein the augmented parameter represents a plurality of parameters that have been grouped together to decrease a number of unique parameters in a scaled parameterized rule set, wherein transforming the parameter includes dividing the parameter by a scaling factor and shifting the parameter;

matching the augmented parameter to the scaled parameterized rule set, wherein the scaled parameterized rule set references the augmented parameter; and

applying the scaled parameterized rule set to the electronic data transmission.

2. The method as recited in claim 1 further including determining that the parameter is not a designated critical parameter.

3. The method as recited in claim 1 further including determining that the parameter is a referenced parameter.

4. The method as recited in claim 1 wherein the parameter is a port number.

5. The method as recited in claim 1 wherein the network transmission is a packet.

6. The method as recited in claim 1 wherein the network transmission is a flow.

7. A method for parameterizing a set of rules comprising:

electronically processing, using a processor, a value associated with a port and a protocol by dividing the value by a scaling factor and shifting the value;

returning an augmented value, wherein the augmented value corresponds to a plurality of values that have been grouped together to decrease a number of unique values in a parameterized rule set; and

expressing the parameterized rule set in terms of the augmented value.

8. The method as recited in claim 7 wherein processing the value includes determining whether the value is part of a critical set of values.

9. The method as recited in claim 7 further including updating a bitmap to indicate that the value is referenced by a rule.

10. A system for evaluating a data transmission comprising:

an interface configured to intercept the transmission;

a processor configured to;

transform a parameter associated with the data transmission into an augmented parameter wherein the augmented parameter represents a plurality of parameters that have been grouped together to decrease a number of unique parameters in a scaled parameterized rule set, wherein transforming the parameter includes dividing the parameter by a scaling factor and shifting the parameter;

match the augmented parameter to the scaled parameterized rule set wherein the scaled parameterized rule set references the augmented parameter; and

apply the scaled parameterized rule set to the data transmission; and

a memory coupled with the processor and configured to provide the processor with instructions.

11. The system as recited in claim 10 wherein the processor is further configured to determine that the parameter is not a designated critical parameter.

12. The system as recited in claim 10 wherein the processor is further configured to determine that the parameter is a referenced parameter.

13. The system as recited in claim 10 wherein the parameter is a port number.

14. The system as recited in claim 10 wherein the network transmission is a packet.

15. A non-transitory computer readable storage medium having embodied thereon computer instructions which when executed by a computer cause the computer to perform a method comprising:

transforming a parameter associated with the data transmission into an augmented parameter wherein the augmented parameter represents a plurality of parameters that have been grouped together to decrease a number of unique parameters in a scaled parameterized rule set, wherein transforming the parameter includes dividing the parameter by a scaling factor and shifting the parameter;

matching the augmented parameter to the scaled parameterized rule set wherein the scaled parameterized rule set references the augmented parameter; and

applying the scaled parameterized rule set to the data transmission.