Microsoft Technology Licensing, LLC

Tanmay Arun Ganacharya

Abhishek Kumar Singh

Scott Lambert

Vladimir Lifliand

Evgeney Ryzhyk

Nikola J Livic

Swapnil Bhalode

Described is a generic protocol decoder that analyzes network traffic or file data to look for a signature, and signals an intrusion prevention mechanism/system if the signature is matched. In one aspect, the generic decoder is built using generic application-level protocol analysis language (GAPAL) primitives. These primitives provide various capabilities, including pattern matching, skipping, reading data, copying variable data and comparing data. The generic decoder may be coupled to a pre-developed protocol parser that provides the decoder with the data to analyze.

Generic protocol decoder for generic application-level protocol signatures

Methods, systems, and computer-readable media are disclosed for packet sanitization. A particular method intercepts a packet of a packet stream, where the packet stream is transmitted in accordance with a particular protocol. The packet is analyzed based on a specification associated with the particular protocol. Based on the analysis, a data value of a field of the packet is replaced with a sanitized data value to create a sanitized packet. The sanitized packet may be injected into the packet stream or may optionally be forwarded to a signature module that checks the sanitized packet for malicious content. When malicious content is found, the sanitized packet may be dropped, the sanitized packet may be logged, the sanitized packet may be redirected, or a notification regarding the sanitized packet may be sent to an administrator.

Sanitization of packets

A human-readable list of patch differences ranked by weight helps vulnerability analysts allocate their time. From binary code, identified source functions and recognized sink functions are used when assigning relative weights to changes caused by a patch. Source functions are identified using an export table, import table, and remote procedure call interface. Sink functions are recognized using blacklisted functions, patch-targeted functions, memory functions, string functions, and functions called with mismatched parameters. A change prioritizer assigns weights based on an architectural graph and a set of prioritization rules that specify what kind of change is made by a patch, and what kind of function is changed. Weight assignments may be additive. Rules may assign certain kinds of change a higher priority for subsequent scrutiny by an analyst.

Growing community of inventors

Kirkland, WA, United States of America

Tanmay Arun Ganacharya