Patent Application
20070192856
The invention relates to devices for detecting and dealing with specific symbol patterns from data streams. More specifically, the invention relates to a system for detecting events of significance whose presence cannot be concluded from the detection of a single specific symbol pattern.
The field of network security has developed in the last few years in an attempt to render more secure current networks not only from intrusion attacks but from all types of threats. Unfortunately, the types of threats to networks have also equally developed. One development that network security scanners have to deal with is more sophisticated instruction attacks.
Currently, data scanners scan a network's incoming and outgoing data traffic for telltale signs for possible attacks. Specific data or symbol patterns can signal a possible attack. However, some symbol patterns which may appear harmless can be the precursor to a more sophisticated attack. The appearance of such symbol patterns may, by itself, not be a cause for alarm. However, these symbol patterns in conjunction with other events (such as the detection of other symbol patterns that, by themselves, may also seem harmless) may indicate the possible presence of an attack. Present data scanners are unable to or have difficulty with detecting such attacks for detection of such attacks requires complex logic that uses knowledge of previous events in conjunction with present occurrences. Present data scanners are unable to track or test relationships between previous events/symbol patterns and present events/symbol patterns.
Another issue with current data scanners is in their configurability. Given the rapid pace of developments in not only countermeasures against attacks but also in the rapid growth of the variety of attacks, any data scanner system must, ideally, be easily reconfigurable. Such configurability would allow end users to quickly adjust not just the symbol patterns being scanned for but also the various relationships between symbol patterns that may indicate the presence of an event of significance such as an attack.
Based on the above, there is therefore a need for a system which can quickly determine, on the basis of user defined rules, whether a significant event, such as an attack, may be present. Such a system should, ideally, be easily configurable and adjustable to take into account newer and more sophisticated attacks against networks and other data systems.
A better understanding of the invention will be obtained by considering the detailed description below, with reference to the following drawings in which:
The detailed description describes herein embodiments of methods and systems for determining which groups of instructions are to be executed when a specific symbol patterns has been detected. A prefetch block receives an identification of the symbol pattern detected. The prefetch block then retrieves one or more groups of instructions which relate to rules affected by that particular symbol pattern. These are passed to an execution block that retrieves state information for each user defined rule from which the groups of instructions originate. The execution block then checks, for each group of instructions, the state information. If the state information indicates that a particular group of instructions can be executed, the execution block executes that group.
In one embodiment, a system for executing predetermined instructions when a predetermined symbol pattern is detected, said predetermined instructions being based on a plurality of user predetermined rules, the system comprises
a prefetch block for receiving an identification of a detected symbol pattern and for retrieving at least one group of instructions from a reaction memory, the or each group of instructions being identified as being executable only when said detected symbol patterns is detected, the or each group of instructions being associated with one of said plurality of user predetermined rules; and
an execution block for receiving said at least one group of instructions from said prefetch block and for retrieving state data from a state memory, said state data relating to said plurality of user predetermined rules such that each rule is associated with a particular subset of said state data;
wherein for each of said at least one group of instruction received by said execution block from said prefetch block, said execution block retrieves specific state data associated with a rule which is associated with said group of instructions;
and wherein for each group of instructions, said execution block executes the group of instructions received from said prefetch block only if said specific state data indicates that said group of instructions may be executed.
In another embodiment, a method for determining which groups of instructions from a plurality of groups of instructions are to be executed when a specific symbol pattern is detected in a data stream, each group of instructions being associated with one specific user defined rule, the method comprising the steps of:
a) receiving an identification of said specific symbol pattern which has been detected in said data stream;
b) retrieving at least one group of instructions associated with said specific symbol pattern, said at least one group of instructions being executable only when said specific symbol pattern has been detected;
c) retrieving state information associated with specific user defined rules, said specific user defined rules being associated with said at least one group of instructions retrieved in step b);
d) for each group of instructions retrieved in step b), determining if said group of instructions are to be executed based on state information retrieved in step c); and
e) for each group of instructions retrieved in step b), executing said group of instructions in the event said group of instructions are to be executed based on results of step d).
In yet another embodiment, a method of organizing groups of instructions, each group being executable only if a specific symbol pattern is detected, each group being associated with a specific symbol pattern and with one predefined rule, the method comprising the steps of:
a) receiving a plurality of rules, each rule having at least one group of instructions;
b) determining which symbol patterns are associated with multiple groups of instructions;
c) for each symbol pattern, gathering groups of instructions associated with said symbol pattern from said plurality of rules; and
d) for each symbol pattern, storing said groups of instructions as a set of groups associated with said symbol pattern.
Referring to
The data stream 40 is received by the pattern matcher 20. The pattern matcher 20 scans the data stream 40 for specific predetermined symbol patterns preset by the end user. When the pattern matcher 20 detects a symbol pattern it is looking for in the data stream 40, an identification of this detected symbol pattern is sent to the system 10 to determine which rules and which states are affected. It should be noted that, instead of merely the identification of the detected symbol pattern, auxiliary match information may also be sent to the system 10. Such auxiliary match information may be the position of the symbol pattern in the stream and the matched data or a portion of the matched pattern. The matched data or its portion may also be transformed prior to being passed to the system 10. The length of the matched pattern and the time of the detection of the pattern may also form part of the auxiliary match information.
The system 10 has a prefetch block 50 and an execution block 60. The prefetch block 50 receives the identification of the detected symbol pattern with or without the auxiliary match information. The prefetch block 50 then retrieves groups of instructions (or reaction routines) from a reaction memory 70. These reaction routines are the possible measures to be taken when a particular symbol pattern is detected. These varied groups of instructions are then sent to the execution block 60. The symbols surrounding the detected symbol pattern may also be sent to the execution block 60.
After the execution block 60 receives the reaction routines from the prefetch block 50, the execution block 60 retrieves state information from state memory 80. The state information relates to the various groups of instructions received by the execution block 60 from the prefetch block 50. For each group of instructions received by the execution block 60 from the prefetch block 50, the execution block 60 checks related state information form the state memory 80. If the state information indicates that the reaction routine can be executed, then the execution block 60 executes that reaction routine. If, on the other hand, the state information indicates that the reaction routine cannot be executed, the execution block 60 then moves to the next group of instructions. If, because of the execution of the group of instructions, the state information gets altered, the altered state information is written back to the state memory 80.
For clarity, it should be noted that the groups of instructions in the reaction memory and the state information are based on user defined stateful rules. These rules are predetermined and are set by the end user with each rule being for various types of threats, attacks, or contingencies. Each statefull rule contains state information and is defined with different and possibly multiple states, each state having different and possibly multiple relevant or associated patterns. Each relevant or associated symbol pattern has a group of instructions or a reaction routine associated with it, each reaction routine being composed of at least one instruction. The instructions in the reaction routine can be comparisons, logic branches, mathematical operations, logical operations, logic branches based on logical/mathematical tests, and other general operations including state change instructions. It should be clear that, within a rule, different states may have identical associated patterns but with identical associated patterns having possibly different reaction routines associated with them. This means that reaction routines associated with identical associated patterns will only be executed if the rule is in the proper state for that reaction routine.
The user defined rules take a form which looks like the pseudo code description of a classic state machine with, as noted above, comparisons, branches, conditional branches and the like. As an example of such a user defined stateful rule,
The reaction routines or groups of instruction may perform any of the following operations: addition, subtraction, bitwise AND, and bitwise OR. Within each rule, the reaction routines can use general purpose register values (the GPRV seen in the example) as variables. For logic control, an if/then or if/then/else construct can be used. The condition in the if/then or if/then/else constructs can be mathematical or logical in nature. The conditions can be any of the following: equals (==), not equals (!=), greater than (>), greater than or equal (>=), less than (<), or less than or equal (<=).
The reaction routines also allow for changes to the state that a rule is in. The rules have an initial or reset state, as can be seen from the sample in
To convert the rules from the end user, a compiler is used. The compiler processes the multiple rules and gathers the various relevant patterns and their associated reaction routines or groups of instructions together such that all reaction routines related to a specific pattern are grouped together. However, it should be noted that each reaction routine, regardless of grouping, is still identified with not only its associated pattern that would trigger the reaction routine's execution but also the rule from which the reaction routine originated and the state the rule has to be in to execute the reaction routine. The groups of reaction routines, their triggering relevant pattern, their triggering state, and an identification of their originating rule can be stored in the reaction memory. It should be noted that the compiler can be constructed according to well-known compiler techniques and technologies. Such techniques can be found in texts such as Compilers by Aho, Sethi, and Ullman (Addison-Wesley, 1986). The grouping of the various reaction routines by their triggering symbol pattern effectively allows the reaction routines to be stored in a database in the reaction memory and to be keyed or indexed by their triggering symbol patterns.
Once the user generated rules have been processed by the compiler software, the groups generated can be stored in the reaction memory and the identification or association with the specific rules is also stored. This association is correlated with the state information in the state memory. In the state memory, each rule is allocated a certain amount of storage so that the state for that rule can be stored. The storage area for each rule may also be used to store data related to relevant patterns detected in the data stream.
Referring to
Within each partition, a section of memory is allocated for each rule in the session. This can be seen in the memory diagram of
For ease of reference and for ease of initialization, a portion of each session's memory is set aside for a quick access section 110 (see 110A-110D in
To allocate the proper amount of storage space to each rule in the state memory, and to store the reaction routines (or groups of instructions) in the reaction memory, linker/loader software is used once the compiler processes the user defined rules. The linker/loader, once it processes the product of the compiler, allocates the proper amount of storage for each rule in the state memory. The linker/loader also determines how much storage is required for the reaction routines to be stored in the reaction memory.
As noted above, the compiler groups the reaction routines according to the triggering symbol patterns. The compiler follows the method outlines in the flowchart of
For clarity,
The organization of the reaction routines and the state information allows the execution of the method outlined in the flowchart of
Regarding implementation of the system 10 and of the engine 30, the engine may be implemented as an application specific integrated circuit (ASIC). The pattern matcher 20 may be any pattern matcher subsystem that receives the data stream and compares the data stream symbols with a database of target symbol patterns. One possible pattern matcher is that discussed in US patent application Ser. No. 11/261,480 entitled Data Scan Mechanism, the disclosure of which is incorporated herein by reference.
The system 10 may be a combination of ASIC or combinational circuits. The prefetch block 50, depending on the implementation, may be part of a monolithic ASIC with the execution block 60 being implemented as a processor core. Similarly, the prefetch block 50 may be implemented separately from the execution block 60. However, in the interests of greater speed in throughput, it may be advantageous to have both the prefetch block 50 and the execution block 60 on a single ASIC.
The memory subsystems, the state memory 80 and the reaction memory 70, may be external to the system 10 and even external to the engine 30. These memory subsystems may be implemented as static RAM or dynamic RAM modules coupled closely to the system 10.
The system 10 allows end users to change stateful rules for dealing with various possible intrusion attacks. Should a new threat appear, the end user can develop new stateful rules for dealing with this new threat. The new rules can then be compiled and used with the system, thereby ensuring that the system can detect the new threat and alert the user if that threat materializes. It should be noted that while the above system can execute various instructions for dealing with and detecting various patterns, such as patterns that may be separated by multiple symbols in the data stream, the system can deal with the detection of such patterns by the simple expediency of generating a report for the end user. Thus, for some given patterns, the execution block 60 may generate a specific report while for other patterns, the execution block 60 may generate other reports.
While the principles of the invention have been described above in connection with specific apparatus, it is to be clearly understood that this description is made only by way of example and not as a limitation on the scope of the invention.
A person understanding this invention may now conceive of alternative structures and embodiments or variations of the above all of which are intended to fall within the scope of the invention as defined in the claims that follow.
