US6499107B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and system for adaptive network security using intelligent packet analysis
Assignee: Cisco Technology Inc
•
Filing: 1998-12-29
•
Granted: 2002-12-24
•
Expires: 2018-12-29
Abstract
Abstract A method and system for adaptive network security using intelligent packet analysis are provided. The method comprises monitoring network data traffic. The network data traffic is analyzed to assess network information. A plurality of analysis tasks are prioritized based upon the network information. The analysis tasks are to be performed on the monitored network data traffic in order to identify attacks upon the network.
Inventors
- 👤 Robert E. Gleichauf
- 👤 Daniel M. Teal
- 👤 Kevin L. Wiley
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-07 23:34
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0227; H04L63/0263; H04L43/00; H04L63/14; H04L63/1408; H04L43/08; H04L43/0805; H04L43/0817; H04L43/18
Claims Analysis
Total Claims: 58
Claim 1
Independent Claim
96 words
A computer implemented method for adaptive network security using intelligent packet analysis, comprising: monitoring network data traffic; analyzing the network data traffic to assess network information; prioritizing a plurality of analysis tasks based upon the network information, the analysis tasks to be performed on the monitored network data traffic in order to identify attacks upon the network; wherein the plurality of analysis tasks includes a plurality of comparisons between the monitored network data traffic and a plurality of attack signatures; and disabling a particular attack signature based upon an assigned priority of the particular attack signature.
Claim 2
Dependent Claim
96 words
A computer implemented method for adaptive network security using intelligent packet analysis, comprising: monitoring network data traffic; analyzing the network data traffic to assess network information; prioritizing a plurality of analysis tasks based upon the network information, the analysis tasks to be performed on the monitored network data traffic in order to identify attacks upon the network; wherein the plurality of analysis tasks includes a plurality of comparisons between the monitored network data traffic and a plurality of attack signatures; and disabling a particular attack signature based upon an assigned priority of the particular attack signature.
Claim 3
Dependent Claim
23 words
The method of claim 1 , further comprising disabling a particular analysis task based upon an assigned priority of the particular analysis task.
Claim 4
Dependent Claim
26 words
The method of claim 2 , further comprising: monitoring a processor utilization; and performing the disabling step if the processor utilization exceeds a first defined threshold.
Claim 5
Dependent Claim
23 words
The method of claim 3 , further comprising re-enabling the particular analysis task if the processor utilization drops below a second defined threshold.
Claim 6
Dependent Claim
25 words
The method of claim 2 , further comprising: monitoring memory utilization; and performing the disabling step if the memory utilization exceeds a third defined threshold.
Claim 7
Dependent Claim
23 words
The method of claim 5 , further comprising re-enabling the particular analysis task if the memory utilization drops below a fourth defined threshold.
Claim 8
Dependent Claim
42 words
The method of claim 1 , wherein the prioritizing step comprises: determining a probable success of a particular attack upon the network based upon the network information; and assigning a priority to the particular analysis task intended to detect the particular attack.
Claim 9
Dependent Claim
31 words
The method of claim 1 , further comprising: comparing the network information to existing network information to determine updated network information; and repeating the prioritizing step using the updated network information.
Claim 10
Dependent Claim
35 words
The method of claim 1 , further comprising: prioritizing a plurality of system services based upon the network information; and disabling a particular system service based upon an assigned priority of the particular system service.
Claim 11
Dependent Claim
18 words
The method of claim 1 , wherein the analyzing step comprises determining a device coupled to the network.
Claim 12
Dependent Claim
22 words
The method of claim 1 , wherein the analyzing step comprises determining an operating system of a device coupled to the network.
Claim 13
Dependent Claim
21 words
The method of claim 1 , wherein the analyzing step comprises determining a service of a device available to the network.
Claim 14
Dependent Claim
22 words
The method of claim 1 , wherein the analyzing step further comprises identifying a potential vulnerability of a device on the network.
Claim 15
Dependent Claim
16 words
The method of claim 1 , further comprising maintaining the network information in a network map.
Claim 16
Dependent Claim
19 words
The method of claim 1 , wherein the plurality of analysis tasks includes protocol analysis on the monitored traffic.
Claim 17
Dependent Claim
15 words
The method of claim 15 , wherein the plurality of analysis tasks includes checksum verification.
Claim 18
Dependent Claim
16 words
The method of claim 15 , wherein the plurality of analysis tasks includes IP fragment reassembly.
Claim 19
Dependent Claim
16 words
The method of claim 15 , wherein the plurality of analysis tasks include TCP stream reassembly.
Claim 20
Dependent Claim
15 words
The method of claim 15 , wherein the plurality of analysis tasks includes timeout calculations.
Claim 21
Dependent Claim
95 words
A computer method for adaptive network security using intelligent packet analysis, comprising: monitoring network data traffic; analyzing the network data traffic to assess network information; prioritizing a plurality of protocol analyses to be performed on monitored traffic from the network, the protocol analyses for identifying attacks upon the network; monitoring a processor utilization; monitoring memory utilization; disabling a particular protocol analysis based upon an assigned priority if the processor utilization exceeds a first defined threshold; and disabling a particular protocol analysis based upon an assigned priority if the memory utilization exceeds a third defined threshold.
Claim 22
Dependent Claim
95 words
A computer method for adaptive network security using intelligent packet analysis, comprising: monitoring network data traffic; analyzing the network data traffic to assess network information; prioritizing a plurality of protocol analyses to be performed on monitored traffic from the network, the protocol analyses for identifying attacks upon the network; monitoring a processor utilization; monitoring memory utilization; disabling a particular protocol analysis based upon an assigned priority if the processor utilization exceeds a first defined threshold; and disabling a particular protocol analysis based upon an assigned priority if the memory utilization exceeds a third defined threshold.
Claim 23
Dependent Claim
29 words
The method of claim 20 , wherein the analyzing step comprises determining the existence of a device coupled to the network from a packet of monitored network data traffic.
Claim 24
Dependent Claim
29 words
The method of claim 20 , wherein the analyzing step comprises determining an operating system running on a device coupled to the network from the monitored network data traffic.
Claim 25
Dependent Claim
27 words
The method of claim 20 , wherein the analyzing step comprises determining a service of a device coupled to the network from the monitored network data traffic.
Claim 26
Dependent Claim
21 words
The method of claim 20 , further comprising identifying potential vulnerabilities of each device discovered to be coupled to the network.
Claim 27
Dependent Claim
23 words
The method of claim 20 , further comprising re-enabling a disabled protocol analysis if the processor utilization drops below a second defined threshold.
Claim 28
Dependent Claim
22 words
The method of claim 20 , further comprising re-enabling a protocol analysis if the memory utilization drops below a fourth defined threshold.
Claim 29
Dependent Claim
15 words
The method of claim 20 , wherein the plurality of protocol analyses includes checksum verification.
Claim 30
Dependent Claim
16 words
The method of claim 20 , wherein the plurality of protocol analyses includes IP fragment reassembly.
Claim 31
Dependent Claim
16 words
The method of claim 20 , wherein the plurality of protocol analyses includes TCP stream reassembly.
Claim 32
Dependent Claim
15 words
The method of claim 20 , wherein the plurality of protocol analyses includes timeout calculations.
Claim 33
Dependent Claim
31 words
The method of claim 20 , further comprising: comparing the network information to existing network information to determine updated network information; and updating the prioritizing step using the updated network information.
Claim 34
Dependent Claim
35 words
The method of claim 20 , further comprising: prioritizing a plurality of system services based upon the network information; and disabling a particular system service based upon an assigned priority of the particular system service.
Claim 35
Dependent Claim
101 words
A computer implemented method for adaptive network security using intelligent packet analysis, comprising: monitoring network data traffic; analyzing the network data traffic to assess network information; prioritizing a plurality of comparisons between monitored network data traffic and a plurality attack signatures based upon the network information, the attack signatures for identifying attacks upon the network; monitoring a processor utilization; monitoring memory utilization; disabling a particular attack signature based upon an assigned priority if the processor utilization exceeds a first defined threshold; and disabling a particular attack signature based upon an assigned priority if the memory utilization exceeds a third defined threshold.
Claim 36
Dependent Claim
101 words
A computer implemented method for adaptive network security using intelligent packet analysis, comprising: monitoring network data traffic; analyzing the network data traffic to assess network information; prioritizing a plurality of comparisons between monitored network data traffic and a plurality attack signatures based upon the network information, the attack signatures for identifying attacks upon the network; monitoring a processor utilization; monitoring memory utilization; disabling a particular attack signature based upon an assigned priority if the processor utilization exceeds a first defined threshold; and disabling a particular attack signature based upon an assigned priority if the memory utilization exceeds a third defined threshold.
Claim 37
Dependent Claim
41 words
The method of claim 33 , wherein the prioritizing step comprises: determining a likelihood of success of a potential attack based upon the network information; and prioritizing an attack signature of the potential attack according to the determined likelihood of success.
Claim 38
Dependent Claim
26 words
The method of claim 33 , wherein the analyzing step comprises determining the existence of a device coupled to the network from monitored network data traffic.
Claim 39
Dependent Claim
28 words
The method of claim 33 , wherein the analyzing step comprises determining an operating system type of a device coupled to the network from monitored network data traffic.
Claim 40
Dependent Claim
28 words
The method of claim 33 , wherein the analyzing step comprises determining a service of a device coupled to the network from a packet monitored network data traffic.
Claim 41
Dependent Claim
21 words
The method of claim 33 , further comprising identifying potential vulnerabilities of each device discovered to be coupled to the network.
Claim 42
Dependent Claim
22 words
The method of claim 33 , further comprising re-enabling a disabled comparison if the processor utilization drops below a second defined threshold.
Claim 43
Dependent Claim
22 words
The method of claim 33 , further comprising re-enabling a disabled comparison if the memory utilization drops below a fourth defined threshold.
Claim 44
Dependent Claim
16 words
The method of claim 33 , further comprising maintaining the network information in a network map.
Claim 45
Dependent Claim
31 words
The method of claim 33 , further comprising: comparing the network information to existing network information to determine updated network information; and repeating the prioritizing step using the updated network information.
Claim 46
Dependent Claim
35 words
The method of claim 33 , further comprising: prioritizing a plurality of system services based upon the network information; and disabling a particular system service based upon an assigned priority of the particular system service.
Claim 47
Independent Claim
123 words
A system for adaptive network security using intelligent packet analysis, comprising: an analysis engine coupled to a network, the analysis engine for analyzing network data traffic to assess network information; a protocol engine coupled to the network, the protocol engine for performing a plurality of protocol analyses on the network data traffic to identify attacks upon the network; a signature engine coupled to the network, the signature engine for comparing the network data traffic to a plurality of attack signatures to identify attacks upon the network; and a priority engine coupled to the analysis engine, the protocol engine, and the signature engine, the priority engine for prioritizing the plurality of protocol analyses and the plurality of attack signatures based upon the network information.
Claim 48
Independent Claim
123 words
A system for adaptive network security using intelligent packet analysis, comprising: an analysis engine coupled to a network, the analysis engine for analyzing network data traffic to assess network information; a protocol engine coupled to the network, the protocol engine for performing a plurality of protocol analyses on the network data traffic to identify attacks upon the network; a signature engine coupled to the network, the signature engine for comparing the network data traffic to a plurality of attack signatures to identify attacks upon the network; and a priority engine coupled to the analysis engine, the protocol engine, and the signature engine, the priority engine for prioritizing the plurality of protocol analyses and the plurality of attack signatures based upon the network information.
Claim 49
Dependent Claim
35 words
The system of claim 44 , further comprising a network map coupled to the analysis engine and the priority engine; wherein the analysis engine is operable to maintain the network information in the network map.
Claim 50
Dependent Claim
29 words
The system of claim 44 , wherein the priority engine is further operable to disable a particular analysis task based upon an assigned priority of the particular analysis task.
Claim 51
Dependent Claim
33 words
The system of claim 44 , wherein the priority engine is further operable to: monitor a processor utilization; and disable the particular analysis task if the processor utilization exceeds a first defined threshold.
Claim 52
Dependent Claim
29 words
The system of claim 47 , wherein the priority engine is further operable to re-enable the particular analysis task if the processor utilization drops below a second defined threshold.
Claim 53
Dependent Claim
32 words
The system of claim 44 , wherein the priority engine is further operable to: monitor memory utilization; and disable the particular analysis task if the memory utilization exceeds a third defined threshold.
Claim 54
Dependent Claim
29 words
The system of claim 49 , wherein the priority engine is further operable to re-enable the particular analysis task if the memory utilization drops below a fourth defined threshold.
Claim 55
Dependent Claim
44 words
The system claim 44 , wherein the priority engine is further operable to: determine a probable success of a particular attack upon the network based upon the network information; and assign a priority to the particular analysis task intended to detect the particular attack.
Claim 56
Dependent Claim
30 words
The system of claim 44 , wherein the network information comprises: a device coupled to the network; an operating systems running on the device; and services available on the device.
Claim 57
Dependent Claim
21 words
The system of claim 52 , wherein the network information further comprises a potential vulnerability of the device on the network.
Claim 58
Dependent Claim
25 words
The system of claim 44 , wherein the priority engine is further operable to prioritize a plurality of system services based upon the network information.
References Cited (Backward Citations)
US5101402A
Cited
US5032979A
Cited
US5278901A
Cited
US5621889A
Cited
US5448724A
Cited
US5414833A
Cited
US5606668A
Cited
US5555377A
Cited
US5557742A
Cited
US5524238A
Cited
US5634008A
Cited
US5488715A
Cited
US5699513A
Cited
US5751964A
Cited
US5793763A
Cited
US5826014A
Cited
US5931946A
Cited
US5798706A
Cited
US5886643A
Cited
US5991881A
Cited
US5796942A
Cited
US5805801A
Cited
US6128642A
Cited
US5919257A
Cited
US6108310A
Cited
US6088804A
Cited
US6279113B1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2005-12-23 | 2006-06-24 | 2006-12-24 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2009-12-23 | 2010-06-24 | 2010-12-24 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2013-12-23 | 2014-06-24 | 2014-12-24 | $7700.00 | Window Closed / Lapsed |