System and method for deep packet inspection and intrusion detection

Patent metadata

Field	Value
Publication number	US-9336239-B1
Application number	US-201313742675-A
Country	US
Kind code	B1
Filing date	Jan 16, 2013
Priority date	Jun 27, 2011
Publication date	May 10, 2016
Grant date	May 10, 2016

Abstract

The present invention relates to a system for deep packet inspection and intrusion detection. The system uses a pattern matching module receiving as an input a data stream in a neural network. Neurons are activated such that when active, the neuron fires to all connecting output neurons to form a neuron spike, each neuron spike from the assigned neuron to a connecting output neuron having a delay. A delay is associated with each input character in the pattern, such that a position of each input character relative to an end of the pattern is stored in an alphabet-pattern-delay matrix (APDFM). An activation matrix (AM) is used to match each input character with a stored pattern to generate a similarity match and determine if the string of characters is the stored pattern.

First claim

What is claimed is:

1. A system for deep packet inspection and intrusion detection, comprising:
one or more processors and a memory, the memory having instructions encoded thereon such that upon execution of the instructions, the one or more processors cause a pattern matching module to perform operations of:
receiving as an input a data stream in a neural network, the data stream having a sequence of characters in a pattern, the data stream received in the neural network such that at each time t, only a single input character is received, with each single input character assigned to a neuron in the neural network;
activating the neuron assigned to the single character such that when active, the neuron fires to all connecting output neurons to form a neuron spike, each neuron spike from the assigned neuron to a connecting output neuron having a delay,
determining a delay associated with each input character in the pattern, such that a position of each input character relative to an end of the pattern is stored in an alphabet-pattern-delay matrix (APDFM);
matching, with an activation matrix (AM), each input character with a stored pattern to generate a similarity match, such that if the similarity match exceeds a predetermined threshold, the sequence of characters in the input data stream is identified as the stored pattern; and
wherein in matching with an activation matrix, the system performs matching by performing operations of:
assuming that a pattern to be matched is of length (n); and
adjusting a firing threshold to value (p), less or equal than (n), for an output neuron, thereby causing the output neuron to fire when any (p/n) of the input characters of the pattern are matched.

2. The system as set forth in claim 1 , wherein the activation matrix is a matrix formed of columns and rows, with each column corresponding to a time step (t) and a single input character, with the rows corresponding to stored patterns against which the input characters are matched.

3. The system as set forth in claim 2 , wherein when a current input character is matched in the activation matrix, the system determines if the current input character is present in the APDM and performs one of the following operations:
a. if the current input character is not present in the APDM, then a current column of the AM is cleared as the input character (x) is not present in any of the patterns;
b. if the current input character is present in the APDM, then:
i. retrieving a list of patterns from the APDM that contain one or more occurrences of the current input character and the corresponding delays for the current input character within each pattern;
ii. For each pattern (p i ) in the list, adding a one to cell number ((t+d j )mod n) in the AM, where (d j ) is the j th delay associated with current input character in (p i );
iii. determining if any of the cells in column (t) of the AM have exceeded a predetermined threshold for the stored pattern associated with each row;
1. if so, then designating the stored pattern corresponding to that row as a match; and

c. clearing the current column of the AM, and repeating, operations (a) through (b) for a next input character.

4. The system as set forth in claim 3 , wherein in matching with an activation matrix, wraparound occurs through periodic operation of the activation matrix, with a weight (w) being assigned to each output neuron when matching input characters, the weight (w) being a number of times a wraparound occurs.

5. The system as set forth in claim 4 , wherein a frequency at which the operation of clearing the current column of the AM is reduced by providing increasingly higher weights (w) and corresponding thresholds when determining if any of the cells in column (t) of the AM have exceeded a predetermined threshold for the stored pattern associated with each row.

6. The system as set forth in claim 2 , wherein in matching with an activation matrix, the system operates two activation matrices, a first activation matrix for pattern matching and a second activation matrix for clearing in parallel for future uses.

7. The system as set forth in claim 1 , further comprising:
a pre-processing module, the pre-processing module receiving and decoding an input packet stream to generate a stream of input characters in a pattern, wherein a pattern matching module thereafter determines if the pattern in the stream of input characters is matched with any stored patterns, and
an analysis module for logging and filtering the input packet stream if it is determined that the pattern in the stream of input characters is a match with a stored pattern.

8. The system as set forth in claim 1 , further comprising:
a pre-processing module, the pre-processing module receiving and decoding an input packet stream to generate a stream of input characters;
a stream splitting module, the stream splitting module splitting the stream of input characters into parallel streams of characters; and
a plurality of pattern matching modules, each pattern matching module receiving only a portion of the stream of characters and all known stored patterns to determine if a pattern in the portion of the stream of input characters is matched with any stored pattern.

9. The system as set forth in claim 1 , further comprising:
a pre-processing module, the pre-processing module receiving and decoding an input packet stream to generate a stream of input characters in a pattern;
a stream splitting module, the stream splitting module splitting the stream of input characters into multiple complete streams of characters; and
a plurality of parallel pattern matching modules, each pattern matching module receiving a complete stream of characters and only a portion of stored patterns to determine if a pattern in the stream of input characters is matched with any stored pattern in the portion of stored patterns.

10. The system as set forth in claim 1 , further comprising:
a pre-processing module, the pre-processing module receiving and decoding an input packet stream to generate a stream of input characters in a pattern, wherein a pattern matching module thereafter determines if the pattern in the stream of input characters is matched with any stored patterns;
an analysis module for logging and filtering the input packet stream if it is determined that the pattern in the stream of input characters is a match with a stored pattern; and
an inference engine for detecting, in real-time, new anomalous patterns and storing the new anomalous pattern with the stored patterns.

11. The system as set forth in claim 1 , wherein in matching with an activation matrix, wraparound occurs through periodic operation of the activation matrix, with a weight (w) being assigned to each output neuron when matching input characters, the weight (w) being a number of times a wraparound occurs.

12. A computer program product for a deep packet inspection and intrusion detection system, the computer program product comprising computer-readable instructions stored on a non-transitory computer-readable medium that are executable by a computer having a processor for causing the processor to perform operations of:
receiving as an input a data stream in a neural network, the data stream having a sequence of characters in a pattern, the data stream received in the neural network such that at each time t, only a single input character is received, with each single input character assigned to a neuron in the neural network;
activating the neuron assigned to the single character such that when active, the neuron fires to all connecting output neurons to form a neuron spike, each neuron spike from the assigned neur

Assignees

• Hrl Lab Llc

Inventors

• Hoffmann Heiko
• Daily Michael J
• Holland Gavin D
• El Defrawy Karim

Classifications

• G06N3/049 Primary

  Temporal neural networks, e.g. delay elements, oscillating neurons or pulsed inputs · CPC title

• G06F16/583

  using metadata automatically derived from the content · CPC title

• G06N3/0499

  Feedforward networks · CPC title

• G06F17/30247 Primary

  Physics · mapped topic

• G06K9/62

  Physics · mapped topic