Intrusion detection systems and methods

• US 8,381,290 B2
• Filed: 07/17/2009
• Issued: 02/19/2013
• Est. Priority Date: 07/17/2009
• Status: Active Grant

• Current Assignee: Peraton, Inc.
• Original Assignee: Exelis Incorporated (L3Harris Technologies, Inc.)
• Inventors: Sheppard, Martin L.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US12/504,766
• Publication Number:
  US 20110016522A1
• Time in Patent Office: 1,313 Days
• Field of Search: 726/13, 726 22- 25, 713/188, 709/E17.042, 709/E17.044
• US Class Current: 726/22
• CPC Class Codes: G06F 21/563 by source code analysis

Abstract

Systems and methods for intrusion and virus detection in computer networks. Data from a file, network byte stream, or other source is segmented and resulting data items are subjected to multiple processing techniques to obtain respective result values, or thumbprints. The multiple thumbprints for respective data items are then aggregated to obtain a single result value, or aggregate thumbprint. The components of the aggregate thumbprint may be “fuzzified” to allow for less preciseness in the single result value. The aggregate thumbprint is compared to other similarly generated aggregate thumbprints stored in a library. Alerts may be generated when the same aggregate thumbprint is detected multiple times.

Claims

1. A method, comprising:

receiving data via an electronic network;

segmenting the data into data items;

isolating one of the data items to obtain a selected data item;

processing the selected data item in accordance with a first processing technique to obtain a first characteristic metric;

processing the selected data item in accordance with a second processing technique to obtain a second characteristic metric, wherein the second processing technique is different from the first processing technique;

combining the first and second characteristic metrics to obtain an aggregate thumbprint of the selected data item; and

comparing the aggregate thumbprint to a plurality of aggregate thumbprints stored in a library of aggregate thumbprints to determine whether a match exists between the aggregate thumbprint and any of the aggregate thumbprints in the library of aggregate thumbprints,

wherein processing comprises adding to a counter when a subsequent byte has an ASCII value greater than an immediately prior byte, and subtracting from the counter when a subsequent byte has an ASCII vale that is less than an immediately prior byte.

2. The method of claim 1, further comprising decreasing the precision of the first and second characteristic metrics.

3. The method of claim 2, comprising rounding values of the first and second characteristics metrics.

4. The method of claim 1, wherein combining comprises concatenating the first and second characteristic metrics into a string.

5. The method of claim 1, wherein processing comprises counting a number of bytes in the selected data item.

6. The method of claim 1, wherein processing comprises adding even byte values and subtracting odd byte values.

7. The method of claim 1, applying a hashing function to the selected data item after the processing steps.

8. The method of claim 1, further comprising storing in the library of aggregate thumbprints an aggregate thumbprint for which no match exists.

9. The method of claim 1, further comprising generating an alert when a match exists.

10. A method of detecting similar, but non-identical, data, comprising:

selecting a data item from a database;

generating a string, wherein the string is comprised of a plurality individual characteristic metrics in respect to the data item, wherein each characteristic metric has been reduced in precision from an originally calculated value;

comparing the string to a plurality of strings stored in a library of strings to determine whether a match exists between the string and any of the strings stored in the library of strings; and

generating an alert when a match is found or adding the string to the library of strings when a match is not found,

wherein a characteristic metric is determined by adding to a counter when a subsequent byte in the data item has an ASCII value greater than an immediately prior byte, and subtracting from a counter when a subsequent byte in the data item has an ASCII vale that is less than an immediately prior byte.

11. The method of claim 10, wherein each characteristic metric is reduced in precision by rounding the respective characteristic metric.

12. The method of claim 10, wherein a characteristic metric is determined by counting a number of bytes in the data item.

13. The method of claim 10, wherein a characteristic metric is determined by adding even byte values and subtracting odd byte values of bytes in the data item.

14. The method of claim 10, further comprising applying a hashing function to the data item after generating the string.

15. A system for detecting similar data items, comprising:

an analysis module having, or being in communication with, physical memory configured to store electronic data;

a data item database in communication with the analysis module; and

a string library in communication with the analysis module,

wherein the analysis module is configured to

select a data item from the data item database,

generate a string comprised of a plurality individual characteristic metrics in respect to the data item where each characteristic metric is reduced in precision from an originally calculated value,

compare the string to a plurality of strings stored in the string library to determine whether a match exists between the string and any of the strings stored in the string library, and

generate an alert when a match is found, or add the string to the string library when a match is not found,

wherein a characteristic metric is determined by adding to a counter when a subsequent byte in the data item has an ASCII value greater than an immediately prior byte, and subtracting from a counter when a subsequent byte in the data item has an ASCII vale that is less than an immediately prior byte.

16. The system of claim 15, further comprising a server that captures network data and is configured to store the network data in the data item database.

17. The system of claim 15, wherein one of the individual characteristic metrics is a byte count of the data item.

18. The system of claim 15, wherein one of the individual characteristic metrics is a measure of sort order of characters in the data item.