Peer To Patent

Home > Archived Applications > 20080313738 > Prior Art > Detail

Pre-Grant Publication Number: 20080313738

Multi-stage deep packet inspection for lightweight devices

Please help the USPTO examine the application by evaluating the relevance of the publicly submitted prior art to the patent application. Peer To Patent forwards the Top 10 most relevant prior art submissions and their annotations to the USPTO.

Review this prior art and click on the thumbs up (or down) to indicate whether this submission should be forwarded to the USPTO.
If you login then you can add an annotation by typing in the box at the bottom of the screen to comment on the relevance of the prior art to the claims of the patent application.

Prior Art Detail

Annotations(0)

#456US7499412: Active packet content analyzer for communications network

Applies to Claims 1,10,16,2

Submitted by: Diane WillisLast updated: almost 4 years ago

0 thumbs up 0 thumbs down

Summary / Description

Summary / Description	Active packet content analyzer for communications network, has engine coupled to processor and memory, where engine compares data packets with stored signatures to perform action identified in associated rule when match is found

Basic Information

Type of Prior Art	Issued Patents - US

Country	United States of America

Patent/Application #	7499412

Kind Code	United States (US) - United STATES Patent - A

Patentee Name	Net Optics, Inc.

Relevant Pages, Columns, or Lines	Col. 1, Lines 57- Col. 2, Line

URL

Filing Date	July 1, 2005

Additional Information

Notes / To Do

Notes

Excerpt

Excerpt

Abstract: An active packet inspection device for a communications network, comprises a first terminal and a second terminal each adapted to couple the appliance in-line in the network and communicate data packets with network devices. A packet processor is coupled to the first terminal and second terminal and configured to normalize the data packets. A network search engine coupled to the packet processor and the memory, and configured to compare the data packets with the stored signatures, and when a match is found and other specified conditions are met, to perform an action identified in an associated rule. In one aspect, the network search engine includes a network search engine controller and a network search engine table including a memory configured to store a plurality of replicated signatures. Advantages of the invention include the ability to perform deep packet inspections actively on a communications network at high-speed. Excerpt from Col. 1 Line 57 - Col. 2 Line 2: A network search engine .....configured to compare the data packets with the stored signatures, and when a match is found, to perform an action identified in an associated rule. ......... Excerpt from Col. 2 Lines 30-45: ....acts based upon two critical items: protocol rules and matching rules. The invention can detect unauthorized attempts to compromise the security of IP networks, unauthorized transfer of contents and blocks specific suspicious traffic in an IP network.

Relevance

Claims

A method of inspecting packets to detect an attempt at subverting an information processing system, comprising:(a) determining if a first signature of a received packet matches a signature of a known worm or virus;

(b) determining if a second signature of the received packet matches a signature of a known application;

(d) if a match is found in any of the above determinations, sending the received packet to a central verification facility for further analysis.

Relevance

See the Excerpt.

Claim Chart

Some

The method of Claim 1, wherein said steps (a) through (d) are performed in a device embedded in an information processing component.

Relevance

See the Excerpt.

Claim Chart

Some

A system for inspecting packets to detect an attempt at subverting an information processing system, comprising:a device embedded in an information processing component, said embedded device including:a first processor; and

a first memory in communication with said first processor, said first memory for storing a first plurality of processing instructions for directing said first processor to(a) determine if a first signature of a received packet matches a signature of a known worm or virus;

(b) determine if a second signature of the received packet matches a signature of a known application;

(d) if a match is found in any of the above determinations, sending the received packet to a central verification facility for further analysis.

Relevance

See the Excerpt.

Claim Chart

Some

A computer program product comprising a computer useable medium having control logic stored therein for causing a computer to detect an attempt at subverting an information processing system, the control logic comprising:a first computer readable program code means for causing the computer to determine if a first signature of a received packet matches a signature of a known worm or virus;

a second computer readable program code means for causing the computer to determine if a second signature of the received packet matches a signature of a known application;

a third computer readable program code means for causing the computer to determine if a third signature of the received packet matches a signature of a known intrusion packet; and

a fourth computer readable program code means for causing the computer to send the received packet to a central verification facility for further analysis, if a match is found in any of the above determinations.

Relevance

See the Excerpt.

Claim Chart

Some

0 days left