Cisco Technology, Inc.

Adobe, Inc.

Yi Jin

Sandeep Kumar

Karempudi V Ramarao

Sunil Potti

Ricky Keangpo Ho

Tefcros Anthias

Stephen Cho

Fan Du

Alex Yiu-Man Chan

Yuquan Jiang

Christopher Wiborg

Tefcros Anthias, Jr

Alex Yin-Man Chan

Ayush Tyagi

Jonathan Ko

Keshav Vadrevu

Christopher R Wiborg

Systems and methods for configuring data stream filtering are disclosed. In one embodiment, a method for data stream processing comprises receiving an incoming dataset stream at a data stream processing environment, wherein the dataset stream comprises a data stream; configuring with a streaming data filter configuration tool, one or more filter parameters for a data filter that receives the data stream; computing with the streaming data filter configuration tool, one or more filter statistics estimates based on the filter parameters, wherein the filter statistics estimates are computed from sample elements of a representative sample of the data stream retrieved from a representative sample data store; outputting to a workstation user interface the filter statistics estimates; and configuring the data filter to apply the filter parameters to the data stream in response to an instruction from the workstation user interface.

Systems and methods for configuring data stream filtering

A method is disclosed for high-speed processing of structured application messages in a network device. According to one aspect, a network device receives a structured application layer message and identifies, in message classification requirements at the network device, a reference to a classification portion of the structured application layer message and an operation portion of the structured application layer message. The system extracts, based on one or more expressions, a portion of the message for classifying the structured application layer message and classifies the message using the extracted portion and according to the message classification requirements. At least in part by accessing information indicated by one or more location identifiers, at least one operation is performed on the classified structured application layer message.

Method and apparatus for high-speed processing of structured application messages in a network device

A method is disclosed for high-speed processing of structured application messages in a network device. According to one aspect, a network device receives a set of message classification rules that have been prepared beforehand by a system administrator or customer. The system analyzes the message classification rules to determine what part(s) of the message are necessary to classify a message according to the message classification rules. This allows the system to consider only the relevant parts of the message and ignore the rest of the message. The system extracts the portion of the message necessary for classifying the message and classifies the message using the values of the extracted information and the message classification rules. A unique sequence of operations is implied by the message classification and those operations must then be applied to the message.

A network infrastructure element such as a router or switch performs transparent and optimized validation of XML schemas of XML payloads received in the network element. The network element comprises logic for receiving and storing one or more validation scope rules that define a portion of an extensible markup language (XML) schema for validation; receiving and storing the XML schema; receiving over the network an application-layer message comprising one or more of the packets; identifying a particular XML element in an XML payload of the application-layer message, wherein the particular XML element is within the portion of the XML schema defined in the one or more validation scope rules; determining whether the particular XML element conforms to the XML schema; and performing a responsive action based on whether the particular XML element conforms to the XML schema.

XML message validation in a network infrastructure element

A method is disclosed for protecting a network against a denial-of-service attack by inspecting application layer messages at a network element. According to one aspect, when a network element intercepts data packets that contain an application layer message, the network element constructs the message from the payload portions of the packets. The network element determines whether the message satisfies specified criteria. The criteria may indicate characteristics of messages that are suspected to be involved in a denial-of-service attack, for example. If the message satisfies the specified criteria, then the network element prevents the data packets that contain the message from being received by the application for which the message was intended. The network element may accomplish this by dropping the packets, for example. As a result, the application's host does not waste processing resources on messages whose only purpose might be to deluge and overwhelm the application.

Network and application attack protection based on application layer message inspection

Growing community of inventors

San Jose, CA, United States of America

Yi Jin