Extension Model for Improved Parsing and Describing Protocols

• US 20090327993A1
• Filed: 06/27/2008
• Published: 12/31/2009
• Est. Priority Date: 06/27/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Li, Jason, Nagampalli, Narasimha Rao S. S., Chinta, Ramesh, Lifliand, Vladimir
• Granted Patent: US 9,191,397 B2
• Time in Patent Office: Days
• US Class Current: 717/104
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 69/03 Protocol definition or specification protocol conformance testing H04L1/244

Abstract

Described is a technology by which an engine parses data based upon modules arranged in a tree-like model structure. Only those modules that meet a condition with respect to the data are invoked for processing the data. Each child module specifies a parent module and specifies a condition for when the parent is to invoke the child module. As a module processes the data, if a child module'"'"'s specified condition is met, it invokes the corresponding child module, (which in turn may invoke a lower child if its condition is met, and so on). When the data corresponds to protocols, the model facilitates protocol layering. A top level parent may represent one protocol (e.g., TCP), a child beneath may represent a lower-layer protocol (e.g., HTTP), whose children may handle certain types of HTTP commands, or correspond to a signature that the child module is programmed to detect.

Claims

1. In a computing environment, a method comprising, parsing data, including arranging modules in a tree-like structure, in which a child module specifies a parent module and specifies a condition set containing at least one condition for when the parent module is to invoke the child module, the parent module parsing the data, evaluating the data to determine whether to invoke the child module, and if so, to invoke the child module when a corresponding condition is met.

2. The method of claim 1 further comprising, constructing the tree-like structure, including processing a selected module to determine whether the module has a parent, and if not, placing the module as a top-level parent module, and if so, locating the parent module and positioning the module as a child module under the parent and providing the parent with the condition set as to when to invoke the child module.

3. The method of claim 1 wherein parsing the data comprises parsing network traffic, and wherein the parent module comprises a protocol definition and the child module comprises a protocol definition extension.

4. The method of claim 3 wherein the condition set includes a condition that specifies a port or other attribute of the incoming or outgoing data.

5. The method of claim 3 wherein the condition set includes a condition on the data.

6. The method of claim 1 wherein the child module corresponds to a signature, wherein the child module specifies that the child module is to be invoked by the parent module when that signature may be present in parsed data, and wherein the child module includes processing directed towards detecting that signature.

7. The method of claim 1 wherein the child module includes a rule and visitor code associated with that rule, and further comprising, running the visitor code when the rule is encountered during execution.

8. The method of claim 7 wherein the visitor code associated with the rule corresponds to a pre-process and post-process visitor.

9. The method of claim 1 further comprising, maintaining session context management data in association with at least one of the modules.

10. In a computing environment, a system comprising, a parsing engine, and a tree-structured model comprising at least one parent module having at least one child module, the parsing engine accessing the tree-structured model to parse data, including invoking a parent module from a top-level module based upon a condition being met, the parent module providing processing for parsing the data and invoking a child module for further processing upon another condition being met.

11. The system of claim 10 wherein the child module contains information that specifies its parent module and the condition as to when the child module is to be invoked by the parent module.

12. The system of claim 10 wherein parsing the data corresponds to network traffic, and wherein the parent module comprises a protocol definition and the child module comprises a protocol definition extension.

13. The system of claim 12 wherein the condition for invoking the parent module from the top-level module is based on a port at which the network traffic was received.

14. The system of claim 13 wherein the condition for invoking the child module is based on a condition on the data.

15. The system of claim 13 wherein the child module includes logic for detecting specific patterns.

16. The system of claim 13 wherein the child module is a parent to at least one other child module that is invoked upon another condition being met.

17. The system of claim 10 further comprising, a set of session context management data that is maintained in association with the model.

18. One or more computer-readable media having computer-executable instructions, which when executed perform steps, comprising, parsing network traffic at an engine, including accessing a model having a top-level module, invoking a parent module from the top-level module upon a first condition corresponding to the network traffic being met, and invoking a child module to the parent module upon a second condition corresponding to the network traffic being met.

19. The one or more computer-readable media of claim wherein invoking the parent module comprises detecting a particular port corresponding to receiving the network traffic.

20. The one or more computer-readable media of claim wherein the child module corresponds to a signature, and wherein invoking a child module comprises processing the data via logic in the child module to determine if the data matches the signature.