The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Feb. 26, 2019

Filed:

Sep. 21, 2016
Applicant:

Narus, Inc., Sunnyvale, CA (US);

Inventors:

Ignacio Bermudez, Astoria, NY (US);

Marios Iliofotou, Sunnyvale, CA (US);

Marco Mellia, Turin, IT;

Ram Keralapura, San Jose, CA (US);

Maurizio Matteo Munafo, Turin, IT;

Assignee:

Narus, Inc., Sunnyvale, CA (US);

Attorney:
Primary Examiner:
Assistant Examiner:
Int. Cl.
CPC ...
H04L 12/26 (2006.01); G06F 17/30 (2006.01); G06N 99/00 (2010.01); G06F 8/53 (2018.01); H04L 12/24 (2006.01); H04L 29/06 (2006.01); H04L 12/58 (2006.01);
U.S. Cl.
CPC ...
H04L 43/18 (2013.01); G06F 8/53 (2013.01); G06F 17/30861 (2013.01); G06F 17/30867 (2013.01); G06F 17/30908 (2013.01); G06N 99/005 (2013.01); H04L 41/142 (2013.01); H04L 51/34 (2013.01); H04L 69/00 (2013.01);
Abstract

A method for analyzing a binary-based application protocol of a network. The method includes obtaining conversations from the network, extracting content of a candidate field from a message in each conversation, calculating a randomness measure of the content to represent a level of randomness of the content across all conversation, calculating a correlation measure of the content to represent a level of correlation, across all of conversations, between the content and an attribute of a corresponding conversation where the message containing the candidate field is located, and selecting, based on the randomness measure and the correlation measure, and using a pre-determined field selection criterion, the candidate offset from a set of candidate offsets as the offset defined by the protocol.


Find Patent Forward Citations

Loading…