The Boeing Company

Brian D Hanner

Jason Edward Amanatullah

Timothy Chung-Ming Wu

Computer based method for generation of a graph representation of a rule set for searching data transiting a network using a graph-based search model. A set of rules that describe strings or patterns of data to be identified in the data set, is expressed as a graph. As blocks of the data set are obtained for processing, the state of the graph is updated based upon the value of the received data block. The transition to the next state depends upon both the current state and the received data block. As blocks of data are received and processed, the graph is traversed until one of the rules is identified.

Graph generation method for graph-based search

Computer based systems and methods for searching data transiting a network using a graph-based search model. A set of rules that describe strings or patterns of data to be identified in the data set, is expressed as a graph. As blocks of the data set are obtained for processing, the state of the graph is updated based upon the value of the received data block. The transition to the next state depends upon both the current state and the received data block. As blocks of data are received and processed, the graph is traversed until one of the rules is identified.

Graph-based data search

Techniques are provided for determining whether network traffic includes a user identifier of interest. Each byte of network traffic is classified as being either a valid character, an invalid character, or a delimiter character. An information stream can be generated based on the classification. Storage of valid characters in the information stream can be initiated when a first delimiter character is detected. Storage of valid characters in the information stream can be stopped when a second delimiter character is detected. The stored valid characters between the first delimiter character and the second delimiter character can be examined to determine whether the stored valid characters correspond to a user identifier.

Method and apparatus for user identification in computer traffic

A computer-based method for scanning data using string filtering includes compressing a data string using a hashing algorithm to obtain a data-string signature, and then determining that the data-string signature matches a known data-string signatures stored in a lookup table if the signature is determined to have a match in the lookup table.

System and method for string filtering

A computer-based method and system for performing header filtering of data is presented The method comprises compressing the header of a data packet to obtain a header signature and determining if the header signature matches a known header signature. If the header signature is determined to have a match, then the header signature is identified as a known header signature. A header signature may be generated using a multidimensional data compression algorithm. A compression algorithm comprises obtaining the data bits contained in each field of a typical header. Then, a header-field group that corresponds uniquely to each field is determined. Each field is replaced with the header-field group of the corresponding data bits of the field and concatenated to create a header signature.

System and method for multidimensional data compression

A system and method for receiving data packets at a computer system are presented. The method and system comprise receiving at a buffer, at least two data packets. Once received, an ending portion of the first data packet is stored in a buffer, wherein the ending portion comprises at least the last data bit in the first data packet. Next the method and system concatenates the ending portion of the first data packet with a beginning portion of the second data packet so a string search engine can determine if the concatenated data contains a known string of malicious data bits.

Growing community of inventors

Campbell, CA, United States of America

Brian D Hanner