System and method for heuristic determination of network protocols

• US 8,954,578 B2
• Filed: 07/30/2012
• Issued: 02/10/2015
• Est. Priority Date: 07/26/2002
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Freedman, Jerome N.
• Primary Examiner(s): KIM, EDWARD J
• Application Number:
  US13/561,428
• Publication Number:
  US 20130031265A1
• Time in Patent Office: 925 Days
• Field of Search: 709/224, 709/223
• US Class Current: 709/224
• CPC Class Codes: H04L 43/18 Protocol analysers

Abstract

A system, method and computer program product are provided for heuristically identifying protocols during network analysis utilizing a network analyzer. First provided is a sequencing and reassembly (SAR) engine module for sequencing and/or re-assembling network communications. Coupled to the engine module is a plurality of protocol interpreter modules for interpreting protocols associated with the network communications. At least one of the protocol interpreter modules is adapted for heuristically identifying protocols associated with the network communications.

Claims

1. A non-transitory computer readable medium, comprising:

an engine software module for at least one of sequencing and reassembling network communications; and

a plurality of protocol interpreter software modules coupled to the engine software module for identifying protocols associated with network communications, wherein each of the plurality of protocol interpreter software modules is adapted for identifying a particular protocol associated with a network communication based on a port number associated with the network communication, and heuristically identifying the particular protocol associated with a network communication using a plurality of heuristic functions if the particular protocol is not identified via the port number, the heuristic functions being organized based on priorities of the heuristic functions, and wherein the priorities are used to call the heuristic functions in a specific order until the particular protocol is identified; and

wherein each of the plurality of protocol interpreter modules is further adapted for registering the protocol interpreter software module with the engine software module and indicating to the engine software module how the particular protocol is to be reassembled by the engine software module, and wherein registering the protocol interpreter software module with the engine software module includes registering a heuristic table including the plurality of heuristic functions and the associated priorities with the engine software module.

2. The computer readable medium of claim 1, wherein the port number is provisioned in a registered port table that is systematically used to evaluate the particular protocol.

3. The computer readable medium of claim 1, wherein the heuristic functions are provisioned in a table which is organized based on the priorities of the heuristic functions.

4. The computer readable medium of claim 1, wherein the network communication corresponding to the particular protocol is passed to the engine module for subsequent sequencing and reassembling.

5. The computer readable medium of claim 1, wherein the heuristic functions that are provisioned are predetermined.

6. The computer readable medium of claim 1, wherein the heuristic functions that are provisioned are dynamically determined.

7. The computer readable medium of claim 1, wherein, in response to initiation of the system, a plurality of functions are carried out including:

registering a first protocol and associated layer information,

identifying a name and suite to which the first protocol belongs,

assigning another name to the first protocol,

identifying an entry point to the protocol interpreter, and

specifying a length of a protocol data unit (PDU) header.

20. The computer readable medium of claim 1, wherein each of the plurality of protocol interpreter software modules is further adapted for being selectively enabled.

23. The computer readable medium of claim 1, wherein the engine software module is adapted for reassembling the network communication according to the identified particular protocol.

8. A network analyzer comprising:

a memory configured to store data, and

a processor operable to execute instructions associated with the data, the network analyzer being configured to;

register at least one of a plurality of protocol interpreter software modules with an engine software module for identifying protocols associated with network communications, wherein each of the plurality of protocol interpreter software modules is adapted for identifying a particular protocol associated with a network communication based on a port number associated with the network communication, and wherein registering the at least one protocol interpreter software module with the engine software module includes registering a heuristic table including the plurality of heuristic functions and the associated priorities with the engine software module;

indicate, by the at least one protocol interpreter software module, to the engine software module how the particular protocol is to be reassembled by the engine software module;

receive a network communication;

identify a particular protocol associated with the network communication based on a port number associated with the network communication; and

heuristically identify the particular protocol associated with the network communication using a plurality of heuristic functions if the particular protocol is not identified via the port number, the heuristic functions being organized based on priorities of the heuristic functions, and wherein the priorities are used to call the heuristic functions in a specific order until the particular protocol is identified.

9. The network analyzer of claim 8, wherein the port number is provisioned in a registered port table that is systematically used to evaluate the particular protocol.

10. The network analyzer of claim 8, wherein the heuristic functions are provisioned in a table which is organized based on the priorities of the heuristic functions.

11. The network analyzer of claim 8, wherein the network analyzer is further configured to sequence and reassemble the network communication corresponding to the particular protocol.

12. The network analyzer of claim 8, wherein the heuristic functions that are provisioned are predetermined.

13. The network analyzer of claim 8, wherein the heuristic functions that are provisioned are dynamically determined.

21. The network analyzer of claim 8, wherein each of the plurality of protocol interpreter software modules is further adapted for being selectively enabled.

24. The network analyzer of claim 8, wherein the engine software module is adapted for reassembling the network communication according to the identified particular protocol.

14. A method, comprising:

registering at least one of a plurality of protocol interpreter software modules with an engine software module for identifying protocols associated with network communications, wherein each of the plurality of protocol interpreter software modules is adapted for identifying a particular protocol associated with a network communication based on a port number associated with the network communication, and wherein registering the at least one protocol interpreter software module with the engine software module includes registering a heuristic table including the plurality of heuristic functions and the associated priorities with the engine software module;

indicating, by the at least one protocol interpreter software module, to the engine software module how the particular protocol is to be reassembled by the engine software module;

receiving a network communication;

identifying a particular protocol associated with a network communication based on a port number associated with the network communication; and

heuristically identifying the particular protocol associated with the network communication using a plurality of heuristic functions if the particular protocol is not identified via the port number, the heuristic functions being organized based on priorities of the heuristic functions, and wherein the priorities are used to call the heuristic functions in a specific order until the particular protocol is identified.

15. The method of claim 14, wherein the port number is provisioned in a registered port table that is systematically used to evaluate the particular protocol.

16. The method of claim 14, wherein the heuristic functions are provisioned in a table which is organized based on the priorities of the heuristic functions.

17. The method of claim 14, wherein the network communication corresponding to the particular protocol is passed for subsequent sequencing and reassembling.

18. The method of claim 14, wherein the heuristic functions that are provisioned are predetermined.

19. The method of claim 14, wherein the heuristic functions that are provisioned are dynamically determined.

22. The method of claim 14, wherein each of the plurality of protocol interpreter software modules is further adapted for being selectively enabled.

25. The method of claim 14, wherein the engine software module is adapted for reassembling the network communication according to the identified particular protocol.