Intrusion detection using secure signatures
Abstract
A method and device for intrusion detection using secure signatures comprising capturing network data. A search hash value, value employing at least one one-way function, is generated from the captured network data using a first hash function. The presence of a search hash value match in a secure signature table comprising search hash values and an encrypted rule is determined. After determining a search hash value match, a decryption key is generated from the captured network data using a second hash function, a hash function different form the first hash function. One or more of the encrypted rules of the secure signatures table having a hash value equal to the generated search hash value are then decrypted using the generated decryption key. The one or more decrypted secure signature rules are then processed for a match and one or more user notifications are deployed if a match is identified.
- Inventors:
- Issue Date:
- Research Org.:
- Idaho National Laboratory (INL), Idaho Falls, ID (United States)
- Sponsoring Org.:
- USDOE
- OSTI Identifier:
- 1159917
- Patent Number(s):
- 8850583
- Application Number:
- 13/785,349
- Assignee:
- U.S. Department of Energy (Washington, DC)
- Patent Classifications (CPCs):
-
H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- DOE Contract Number:
- AC07-05ID14517
- Resource Type:
- Patent
- Country of Publication:
- United States
- Language:
- English
- Subject:
- 97 MATHEMATICS AND COMPUTING
Citation Formats
Nelson, Trent Darnel, and Haile, Jedediah. Intrusion detection using secure signatures. United States: N. p., 2014.
Web.
Nelson, Trent Darnel, & Haile, Jedediah. Intrusion detection using secure signatures. United States.
Nelson, Trent Darnel, and Haile, Jedediah. Tue .
"Intrusion detection using secure signatures". United States. https://www.osti.gov/servlets/purl/1159917.
@article{osti_1159917,
title = {Intrusion detection using secure signatures},
author = {Nelson, Trent Darnel and Haile, Jedediah},
abstractNote = {A method and device for intrusion detection using secure signatures comprising capturing network data. A search hash value, value employing at least one one-way function, is generated from the captured network data using a first hash function. The presence of a search hash value match in a secure signature table comprising search hash values and an encrypted rule is determined. After determining a search hash value match, a decryption key is generated from the captured network data using a second hash function, a hash function different form the first hash function. One or more of the encrypted rules of the secure signatures table having a hash value equal to the generated search hash value are then decrypted using the generated decryption key. The one or more decrypted secure signature rules are then processed for a match and one or more user notifications are deployed if a match is identified.},
doi = {},
journal = {},
number = ,
volume = ,
place = {United States},
year = {Tue Sep 30 00:00:00 EDT 2014},
month = {Tue Sep 30 00:00:00 EDT 2014}
}
Works referenced in this record:
Efficient signature packing for an intrusion detection system
patent, November 2009
- Wilhelm, Jeffrey
- US Patent Document 7,624,446
Detecting public network attacks using signatures and fast content analysis
patent-application, October 2005
- Singh, Sumeet; Varghese, George; Estan, Cristi
- US Patent Application 10/822226; 20050229254
Prioritizing intrusion detection logs
patent-application, October 2005
- Gassoway, Paul A.
- US Patent Application 10/832692; 20050240781
Real-time stateful packet inspection method and apparatus
patent-application, December 2007
- Yoon, Seung Yong; Oh, Jin Tae; Jang, Jong Soo
- US Patent Application 11/633174; 20070297410
Apparatus and Method for High Throughput Network Security Systems
patent-application, March 2008
- Tan, Teewoon; Place, Anthony; Williams, Darren
- US Patent Application 11/859530; 20080077793
Detection of Heavy Users of Network Resources
patent-application, April 2011
- Martin, Cecilia; Huber, John; Wang, Mei
- US Patent Application 12/971358; 20110087779
Cloud-Based Gateway Security Scanning
patent-application, July 2013
- Dubrovsky, Aleksandr; Cheetancheri, Senthilkumar G.; Yanovsky, Boris
- US Patent Application 13/626777; 20130191914
Works referencing / citing this record:
Detection of privilege escalation vulnerabilities using bag of words
patent, October 2016
- Alamuri, Naga Venkata Sunil
- US Patent Document 9,467,467
Network security using encrypted subfields
patent, March 2016
- McGrew, David
- US Patent Document 9,288,186
Filtering network traffic using protected filtering mechanisms
patent, December 2015
- Amoroso, Edward G.; Chandran, Nishanth; Vahlis, Evgene
- US Patent Document 9,219,747