Lionic Corporation

Shih-Wei Chien

Shi-Ming Zhao

Chih-Jen Chang

Meng-Hong Chen

Methods and systems for processing multiple levels of data in system security approaches are disclosed. In one embodiment, a first set and a second set of resources are selected to iteratively and independently reverse multiple levels of format conversions on the payload portions of a data unit from a first file and a data unit from a second file, respectively. The first file and the second file are associated with a first transport connection and a second transport connection, respectively. Upon completion of the aforementioned reversal operations, the payload portions of a first reversed data unit and a second reversed data unit, which correspond to the data unit of the first file and the data unit of the second file, respectively, are inspected for suspicious patterns prior to any aggregation of the data units of the first file or the second file.

Multiple-level data processing system

A method and system for ensuring system security is disclosed. Based on the content of the data units the method and system monitor, the method and system retrieve the states and the dependency relationships among these states that are representative of unwanted patterns. The method and system store the states and the dependency relationships mentioned above in different types of memories according to the frequency of accessing the states. The frequency is calculated by comparing a number of test data patterns with the states in a sequence specified by the dependency relationships. The method and system further identify a set of suspected data units by comparing the data units with the retrieved states in a sequence specified by the retrieved dependency relationships, wherein the content of the set of the suspected data units collectively matches any of the unwanted patterns.

System security approaches utilizing a hierarchical memory system

A method and system for ensuring system security is disclosed. The method and system split a regular expression that corresponds to a number of patterns into sub-expressions. The dependency relationships among the finite automata that correspond to the sub-expressions are maintained. Then, as data units are put through these finite automata in a sequence that is based on the dependency relationships, suspected data units are identified. The suspected data units are the ones containing content that collectively matches one or more of the aforementioned patterns. Identification of the suspected data units is based on the merged results of the finite automata. Depending on the result of identifying the suspected data units, different actions are performed.

System security approaches using sub-expression automata

A method and system for ensuring system security is disclosed. The method and system utilize a first processing unit to split a regular expression that corresponds to a number of patterns into sub-expressions and maintain the dependency relationships among the finite automata that correspond to the sub-expressions. Then, the method and system utilize a second processing unit to move the data units through these finite automata in a sequence that is based on the dependency relationships to identify the suspected data units. The suspected data units are the ones containing content that collectively matches one or more of the aforementioned patterns. Identification of the suspected data units is based on the merged results of the finite automata.

System security approaches using multiple processing units

A method and system that ensures system security is disclosed. Specifically, the method and system formulate a finite automaton that corresponds to a number of patterns. Then, as data units are put through the finite automaton, suspected data units are identified. The suspected data units are the ones containing content that collectively matches one or more of the aforementioned patterns. To identify the suspected data units, the dependency relationships among various states in the finite automaton that have been compressed are relied upon. Depending on the result of identifying the suspected data units, different actions are performed.

Growing community of inventors

Taichung, Taiwan

Shih-Wei Chien