Method and apparatus to perform multiple packet payloads analysis

摘要

A method and apparatus for identifying data patterns of a file are described herein. In one embodiment, an exemplary process includes, but is not limited to, receiving a data packet of a data stream containing a file segment of a file originated from an external host and destined to a protected host of a local area network (LAN), the file being transmitted via multiple file segments contained in multiple data packets of the data stream, and performing a data pattern analysis on the received data packet to determine whether the received data packet contains a predetermined data pattern, without waiting for a remainder of the data stream to arrive. Other methods and apparatuses are also described.

主权项

1. A method for performing re-assembly free deep packet inspection, the method comprising:
receiving a data stream over a communication network, the received data stream comprising a plurality of data packets corresponding to a segment of a file being transmitted in a plurality of segments ordered in a predetermined order; determining that the plurality of data packets in the data stream are not being received in the predetermined order associated with the corresponding file segment, wherein at least one data packet is received before a precedent data packet in the predetermined order is received; storing a local copy of the at least one data packet, wherein the local copy is subsequently retrieved after the precedent data packet is received for comparison to an attack pattern; and preventing the at least one data packet from reaching a recipient until it is verified that previous in-order packets do not contain elements of the attack pattern.