Jerome Freedman

A segmentation and re-assembly (SAR) decode engine receives protocol data units of data from a communication channel between two computers, sequences the protocol data units, and re-assembles the data in the protocol data units into the messages exchanged by the computers. The SAR decode engine is responsible for unpacking the payloads from the protocol data units as instructed by a protocol interpreter associated with the protocol data unit, and for creating and maintaining a flow object… Show more

A segmentation and re-assembly (SAR) decode engine receives protocol data units of data from a communication channel between two computers, sequences the protocol data units, and re-assembles the data in the protocol data units into the messages exchanged by the computers. The SAR decode engine is responsible for unpacking the payloads from the protocol data units as instructed by a protocol interpreter associated with the protocol data unit, and for creating and maintaining a flow object database containing flow objects representing the data flows at each protocol layer. The SAR decode engine creates a protocol flow object for each protocol layer and logically links the protocol flow object to circuit flow objects that define two one-way circuits within the channel. The circuit flow objects linked to a protocol flow object are logical representations of the protocol data units for the next higher protocol layer. For protocols that fragment data, each circuit flow object is a vector list containing one or more vectors that define the length, starting location and position of the data fragments in the immediately lower layer circuit flow objects. Show less

Primary and alternate circuits on protocol flow objects representing application protocol layers in a communications channel are linked to connect multiplexed requests and replies. Various protocol flow objects are arranged in a hierarchical flow tree data structure that corresponds to multiple protocol layers in the channel. One branch of the flow tree data structure is selected to represent a reply, and source-destination address pairs for lower layer protocol flow objects for the reply are… Show more

Primary and alternate circuits on protocol flow objects representing application protocol layers in a communications channel are linked to connect multiplexed requests and replies. Various protocol flow objects are arranged in a hierarchical flow tree data structure that corresponds to multiple protocol layers in the channel. One branch of the flow tree data structure is selected to represent a reply, and source-destination address pairs for lower layer protocol flow objects for the reply are used to identify the branch of the flow tree data structure that represents the corresponding request. In one aspect, the address pairs for network and transport layer protocol flow objects for the reply are used to identify the request branch. In a further aspect, a link layer protocol object corresponding to the link layer protocol object for the reply may be used to reduce the number of network and transport protocol flow objects examined to identify the request branch. Show less

An intrusion detection and analysis system and method are disclosed. The system includes a data monitoring device comprising a capture engine operable to capture data passing through the network and configured to monitor network traffic, decode protocols, and analyze received data. The system further includes an intrusion detection device comprising a detection engine operable to perform intrusion detection on data provided by the data monitoring device. Application program interfaces are… Show more

An intrusion detection and analysis system and method are disclosed. The system includes a data monitoring device comprising a capture engine operable to capture data passing through the network and configured to monitor network traffic, decode protocols, and analyze received data. The system further includes an intrusion detection device comprising a detection engine operable to perform intrusion detection on data provided by the data monitoring device. Application program interfaces are provided and configured to allow the intrusion detection device access to applications of the data monitoring device to perform intrusion detection. The system also includes memory for storing reference network information used by the intrusion detection device to determine if an intrusion has occurred. Show less