Method and an apparatus to perform multiple packet payloads analysis

摘要

A method and an apparatus to perform multiple packet payload analysis have been disclosed. In one embodiment, the method includes receiving a plurality of data packets, each of the plurality of data packets containing a portion of a data pattern, determining whether each of the plurality of data packets is out of order, and making and storing a local copy of the corresponding data packet if the corresponding data packet is out of order. Other embodiments have been claimed and described.

主权项

1. An attack signature detection device, the device comprising:
a network interface that receives a plurality of data packets, each data packet containing an alphanumeric character; and a processor that executes instructions stored in a memory, wherein execution of the instructions by the processor:
matches a portion of the received data packets to a first predetermined pattern by comparing each of a first set of one or more alphanumeric characters of each packet to a first state of a plurality of states stored in memory, wherein the first state of the plurality of states is predefined to correspond to a first alphanumeric character,matches a portion of the received data packets to a second predetermined pattern by comparing each of a second set of one or more alphanumeric characters of each packet to a second state of the plurality of states stored in memory, wherein the second state of the plurality of states is predefined to correspond to a second alphanumeric character, anddetects an attack signature formed by the first and second predetermined patterns, the detection based on the matched portions of the received data packets and the first and second predetermined patterns.