Pattern detection

• US 9,342,709 B2
• Filed: 10/27/2010
• Issued: 05/17/2016
• Est. Priority Date: 10/27/2010
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Company (HP Inc.)
• Inventors: Warren, David A., LaVigne, Bruce E.
• Primary Examiner(s): Siddiqi, Mohammad A
• Application Number:
  US13/876,586
• Publication Number:
  US 20130191917A1
• Time in Patent Office: 2,029 Days
• Field of Search: 726/23, 713/150, 709/224, 709/230
• US Class Current: 1/1
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 49/9042 Separate storage for different parts of the packet, e.g. header and payload
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/30 Profiles
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 9/06 the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators

Abstract

Data is moved through a pipeline as processing of the data unrelated to detection of pattern is performed. The detector detects the pattern within the data at a predetermined location or based on a predetermined reference as the data is moved through the pipeline, in parallel with the processing of the data as the data is moved through the pipeline. The detector detects the pattern within the data as the data is moved through the pipeline without delaying movement of the data into, through, and out of the pipeline.

Claims

1. A device, comprising:

a pipeline implemented at least in hardware, through which data is moved to perform processing of the data unrelated to pattern detection; and

a detector implemented at least in hardware, to;

detect a first pattern at a first location within the data, in parallel with the processing of the data as the data is moved through the pipeline and without delaying movement of the data through the pipeline;

access a reference parameter that specifies a location that is relative to a location of the first pattern;

determine a second location based on the reference parameter and the information identifying the first location; and

detect a second pattern at the determined second location in the data.

2. The device of claim 1, further comprising:

a storage to store the first pattern and a bitmask associated with the first pattern, the bitmask identifying do-not-care bits of the associated first pattern, wherein the detector is to detect the first pattern based on bits other than the do-not-care bits.

3. The device of claim 1, wherein the detector is to store, in response to detecting the second pattern, information identifying the second location of the second pattern.

4. The device of claim 3, wherein the detector is to store packet identifying information identifying a packet when the first pattern was detected.

5. The device of claim 1, wherein the detector includes logic to perform an operation based on the detection of the first pattern and the detection of the second pattern.

6. The device of claim 1, wherein the processing of the data performed in parallel with the detecting of the first pattern includes modifying a network address of the data.

7. The device of claim 1, further comprising:

a storage to store the information identifying the first location in response to the detecting of the first pattern, the storage to further store the reference parameter and a further reference parameter providing an indication of a starting point in the data to look for the first pattern.

8. The device of claim 7, wherein the further reference parameter indicates the starting point in a header of a data packet to look for the first pattern.

9. The device of claim 1, wherein the data includes a data packet, and wherein the detecting of the first pattern and the detecting of the second pattern are performed in the data packet.

14. The device of claim 9, wherein the detector is to indicate detection of at least one of a virus, a trojan, a worm, or spam in response to the detecting of the first pattern and the second pattern in the data packet.

10. A method, comprising:

detecting, by a detector implemented at least in hardware, a first pattern within input data in a pipeline, the detecting being performed in parallel with processing of the input data as the input data is moved through the pipeline and without delaying movement of the input data into, through and out of the pipeline;

in response to the detecting, storing information identifying a first location of the first pattern in the input data;

accessing, by the detector, a reference parameter that specifies a location in data that is relative to a location of the first pattern;

determining, by the detector, a second location based on the reference parameter and the information identifying the first location; and

detecting, by the detector, a second pattern at the determined second location in the input data.

11. The method of claim 10, further comprising accessing, by the detector, a further reference parameter indicating a location in the input data to look for the first pattern, the indicated location located in a header of a data packet.

12. The method of claim 11, further comprising:

associating with the first pattern a starting point in relation to the location indicated by the further reference parameter and a stopping point in relation to the starting point to identify a window of data where the detector is to look for the first pattern.

13. The method of claim 10, further comprising:

performing a logical operation based on the detection of the first pattern and the second pattern.

15. The method of claim 10, wherein the processing of the input data performed in parallel with the detecting of the first pattern includes modifying a network address of the input data.

16. The method of claim 10, wherein the input data includes a data packet, and wherein the detecting of the first pattern and the detecting of the second pattern are performed in the data packet.

17. The method of claim 16, further comprising:

indicating detection of at least one of a virus, a trojan, a worm, or spam in response to detecting of the first pattern and the second pattern in the data packet.

18. A device, comprising:

a storage device to store

a plurality of patterns having a length of a predetermined number of bytes; and

a plurality of parameters, associated with the plurality of patterns, each of the plurality of parameters including a reference, a start and a stop identifying where to detect the associated each of the plurality of patterns; and

a plurality of correlators implemented in hardware and equal in number to a number of bytes of each row of a plurality of rows of a pipeline,

each correlator is to provide a number of bytes of data that have been matched to one or more of the plurality of patterns, and

each correlator having a unique offset to detect one or more of the plurality of patterns beginning at a different starting byte position of data within a given row of the pipeline; and

wherein one of the plurality of patterns is indicated as having been detected within the data based on the number of bytes of the data that have been matched to the respective pattern by each correlator.

19. The device of claim 18, wherein the reference identifies one of a plurality of layer headers, a packet payload, and a match location of a second one of the plurality of patterns, and wherein the start represents a starting point in a packet in relation to the reference, and the stop represents a stopping point in relation to the starting point to identify a window of bytes where each of the plurality of patterns may be detected.

20. The device of claim 19, further including logic to perform an operation based on the detected patterns.