US6578147B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Parallel intrusion detection sensors with load balancing for high speed networks
Assignee: Cisco Technology Inc
•
Filing: 1999-01-15
•
Granted: 2003-06-10
•
Expires: 2019-01-15
Abstract
Abstract Various embodiments of a method and system for detecting unauthorized signatures to or from a local network. Multiple sensors are connected at an internetworking device, which can be a router or a switch. The sensors operate in parallel and each receives a portion of traffic through the internetworking device, at a session-based level or at a lower (packet-based) level. Depending on the type of internetworking device (router or switch) the load balancing mechanism that distributes the packets can be internal or external to the internetworking device. Also depending on the level of packet distribution (session-based or packet-based), the sensors share a network analyzer (if session-based) or both a network analyzer and a session analyzer (if packet-based).
Inventors
- 👤 Steven D. Shanklin
- 👤 Gerald S. Lathem
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 12:15
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/14; H04L63/1408; H04L63/1416; H04L67/00; H04L67/01; H04L67/10; H04L67/1001
Claims Analysis
Total Claims: 37
Claim 1
Independent Claim
105 words
A method of detecting unauthorized access on a network as indicated by signature analysis of packet traffic on the network, comprising the steps of: providing a plurality of intrusion detection sensors at a network entry point associated with an internetworking device; balancing the packet load to said sensors, such that said packets are distributed at least at a session-based level; detecting signatures indicated by said packets delivered to said sensors; delivering packets indicating a composite signature from multiple sessions to a network analyzer; detecting composite signatures delivered to said network analyzer; using the results of said detecting steps to determine unauthorized access to said network.
Claim 2
Independent Claim
105 words
A method of detecting unauthorized access on a network as indicated by signature analysis of packet traffic on the network, comprising the steps of: providing a plurality of intrusion detection sensors at a network entry point associated with an internetworking device; balancing the packet load to said sensors, such that said packets are distributed at least at a session-based level; detecting signatures indicated by said packets delivered to said sensors; delivering packets indicating a composite signature from multiple sessions to a network analyzer; detecting composite signatures delivered to said network analyzer; using the results of said detecting steps to determine unauthorized access to said network.
Claim 3
Dependent Claim
26 words
The method of claim 1 , wherein said internetworking device is a router, and wherein said sensors are attached between said router and a local network.
Claim 4
Dependent Claim
22 words
The method of claim 1 , wherein said internetworking device is a switch, and wherein said sensors are integrated into said switch.
Claim 5
Dependent Claim
51 words
The method of claim 1 , wherein said balancing step is performed by distributing said packets at a packet-based level, and further comprising the steps of delivering packets indicating a composite signature to a session analyzer and of using said session analyzer to detect signatures indicated by packets delivered to it.
Claim 6
Independent Claim
105 words
A method of detecting unauthorized access on a network as indicated by signature analysis of packet traffic on the network via a router, comprising the steps of: providing a plurality of intrusion detection sensors between said router and a local network; balancing the packet load to said sensors, such that said packets are distributed at least at a session-based level; detecting signatures indicated by said packets delivered to said sensors; delivering packets indicating a composite signature from multiple sessions to a network analyzer; detecting composite signatures delivered to said network analyzer; using the results of said detecting steps to determine unauthorized access to said network.
Claim 7
Independent Claim
105 words
A method of detecting unauthorized access on a network as indicated by signature analysis of packet traffic on the network via a router, comprising the steps of: providing a plurality of intrusion detection sensors between said router and a local network; balancing the packet load to said sensors, such that said packets are distributed at least at a session-based level; detecting signatures indicated by said packets delivered to said sensors; delivering packets indicating a composite signature from multiple sessions to a network analyzer; detecting composite signatures delivered to said network analyzer; using the results of said detecting steps to determine unauthorized access to said network.
Claim 8
Dependent Claim
51 words
The method of claim 5 , wherein said balancing step is performed by distributing said packets at a packet-based level, and further comprising the steps of delivering packets indicating a composite signature to a session analyzer and of using said session analyzer to detect signatures indicated by packets delivered to it.
Claim 9
Independent Claim
105 words
A method of using a switch to detect unauthorized access on a network as indicated by signature analysis of packet traffic on the network via the switch, comprising the steps of: providing a plurality of intrusion detection sensors within said switch; balancing the packet load to said sensors, such that said packets are distributed at least at a session-based level; detecting signatures indicated by said packets delivered to said sensors; delivering packets indicating a composite signature from multiple sessions to a network analyzer; detecting composite signatures delivered to said network analyzer; using the results of said detecting steps to determine unauthorized access to said network.
Claim 10
Independent Claim
105 words
A method of using a switch to detect unauthorized access on a network as indicated by signature analysis of packet traffic on the network via the switch, comprising the steps of: providing a plurality of intrusion detection sensors within said switch; balancing the packet load to said sensors, such that said packets are distributed at least at a session-based level; detecting signatures indicated by said packets delivered to said sensors; delivering packets indicating a composite signature from multiple sessions to a network analyzer; detecting composite signatures delivered to said network analyzer; using the results of said detecting steps to determine unauthorized access to said network.
Claim 11
Dependent Claim
51 words
The method of claim 7 , wherein said balancing step is performed by distributing said packets at a packet-based level, and further comprising the steps of delivering packets indicating a composite signature to a session analyzer and of using said session analyzer to detect signatures indicated by packets delivered to it.
Claim 12
Dependent Claim
20 words
The method of claim 7 , wherein said balancing step is performed by a load balancing unit of said switch.
Claim 13
Dependent Claim
28 words
The method of claim 7 , wherein said balancing step is performed by an arbitration circuit at each said sensor and an arbitration control bus linking said sensors.
Claim 14
Dependent Claim
90 words
An intrusion detection system for use with a network router that delivers traffic to a local network, comprising: a plurality of intrusion detection sensors connected to a communications link between said router and said local network, each said sensor operable to operate in parallel to perform signature analysis on packet traffic distributed by said router to said sensors on at least a session-based level; and a network analyzer operable to receive packets indicating a composite signature from multiple sessions and to analyze signatures indicated by said packets delivered to it.
Claim 15
Dependent Claim
90 words
An intrusion detection system for use with a network router that delivers traffic to a local network, comprising: a plurality of intrusion detection sensors connected to a communications link between said router and said local network, each said sensor operable to operate in parallel to perform signature analysis on packet traffic distributed by said router to said sensors on at least a session-based level; and a network analyzer operable to receive packets indicating a composite signature from multiple sessions and to analyze signatures indicated by said packets delivered to it.
Claim 16
Dependent Claim
44 words
The system of claim 11 , wherein said router distributes said packets at a packet-based level, and further comprising a session analyzer that receives packets indicating signatures from different packets of the same session and detects signatures indicated by said packets delivered to it.
Claim 17
Dependent Claim
85 words
An improved switch for providing intrusion detection for switched network traffic, the improvement comprising: a plurality of intrusion detection sensors integrated within said switch, each said sensor operable to operate in parallel to perform signature analysis on packet traffic distributed within said switch; a load balancing unit for distributing packets on at least a session-based level to said sensors; and a network analyzer operable to receive packets indicating a composite signature from multiple sessions and to detect signatures indicated by said packets delivered to it.
Claim 18
Dependent Claim
85 words
An improved switch for providing intrusion detection for switched network traffic, the improvement comprising: a plurality of intrusion detection sensors integrated within said switch, each said sensor operable to operate in parallel to perform signature analysis on packet traffic distributed within said switch; a load balancing unit for distributing packets on at least a session-based level to said sensors; and a network analyzer operable to receive packets indicating a composite signature from multiple sessions and to detect signatures indicated by said packets delivered to it.
Claim 19
Dependent Claim
46 words
The switch of claim 13 , wherein said load balancing unit distributes said packets at a packet-based level, and further comprising a session analyzer that receives packets indicating signatures from different packets of the same session and detects signatures indicated by said packets delivered to it.
Claim 20
Dependent Claim
32 words
The switch of claim 13 , further comprising a bus that carries network traffic within said switch to ports of said switch and wherein said sensors are directly connected to said bus.
Claim 21
Dependent Claim
21 words
The switch of claim 13 , wherein said load balancing unit operates by receiving packets and re-transmitting them to said sensors.
Claim 22
Dependent Claim
19 words
The switch of claim 13 , wherein said load balancing unit operates by delivering control signals to said sensors.
Claim 23
Dependent Claim
114 words
An improved switch for providing intrusion detection for switched network traffic, the improvement comprising: a plurality of intrusion detection sensors integrated within said switch, each said sensor operable to operate in parallel to perform signature analysis on packet traffic distributed within said switch; an arbitration bus linking each said sensor for communicating arbitration control signals among said sensors, said arbitration control signals operable to distribute packets to said sensors on at least a session-based level; an arbitration circuit associated with each said sensor for generating said arbitration signals; and a network analyzer operable to receive packets indicating a composite signature from multiple sessions and to detect signatures indicated by said packets delivered to it.
Claim 24
Dependent Claim
114 words
An improved switch for providing intrusion detection for switched network traffic, the improvement comprising: a plurality of intrusion detection sensors integrated within said switch, each said sensor operable to operate in parallel to perform signature analysis on packet traffic distributed within said switch; an arbitration bus linking each said sensor for communicating arbitration control signals among said sensors, said arbitration control signals operable to distribute packets to said sensors on at least a session-based level; an arbitration circuit associated with each said sensor for generating said arbitration signals; and a network analyzer operable to receive packets indicating a composite signature from multiple sessions and to detect signatures indicated by said packets delivered to it.
Claim 25
Dependent Claim
45 words
The system of claim 18 , wherein said arbitration bus distributes said packets at a packet-based level, and further comprising a session analyzer that receives packets indicating signatures from different packets of the same session and detects signatures indicated by said packets delivered to it.
Claim 26
Independent Claim
87 words
A method of detecting unauthorized access on a network, comprising the steps of: providing a plurality of intrusion detection sensors at a network entry point associated with an internetworking device; balancing a packet load to said sensors, such that packets are distributed at a packet-based level; detecting signatures indicated by said packets delivered to said sensors; delivering packets indicating a composite signature to an analyzer; detecting a composite signature delivered to said analyzer; using the results of said detecting steps to determine unauthorized access to said network.
Claim 27
Independent Claim
87 words
A method of detecting unauthorized access on a network, comprising the steps of: providing a plurality of intrusion detection sensors at a network entry point associated with an internetworking device; balancing a packet load to said sensors, such that packets are distributed at a packet-based level; detecting signatures indicated by said packets delivered to said sensors; delivering packets indicating a composite signature to an analyzer; detecting a composite signature delivered to said analyzer; using the results of said detecting steps to determine unauthorized access to said network.
Claim 28
Independent Claim
84 words
A method of detecting unauthorized access on a network, comprising the steps of: providing a plurality of intrusion detection sensors between a router and a local network; balancing a packet load to said sensors, such that packets are distributed at a packet-based level; detecting signatures indicated by said packets delivered to said sensors; delivering packets indicating a composite signature to an analyzer; detecting a composite signature delivered to said analyzer; using the results of said detecting steps to determine unauthorized access to said network.
Claim 29
Independent Claim
84 words
A method of detecting unauthorized access on a network, comprising the steps of: providing a plurality of intrusion detection sensors between a router and a local network; balancing a packet load to said sensors, such that packets are distributed at a packet-based level; detecting signatures indicated by said packets delivered to said sensors; delivering packets indicating a composite signature to an analyzer; detecting a composite signature delivered to said analyzer; using the results of said detecting steps to determine unauthorized access to said network.
Claim 30
Independent Claim
84 words
A method of using a switch to detect unauthorized access on a network, comprising the steps of: providing a plurality of intrusion detection sensors within said switch; balancing a packet load to said sensors, such that packets are distributed at a packet-based level; detecting signatures indicated by said packets delivered to said sensors; delivering packets indicating a composite signature to an analyzer; detecting a composite signature delivered to said analyzer; using the results of said detecting steps to determine unauthorized access to said network.
Claim 31
Independent Claim
84 words
A method of using a switch to detect unauthorized access on a network, comprising the steps of: providing a plurality of intrusion detection sensors within said switch; balancing a packet load to said sensors, such that packets are distributed at a packet-based level; detecting signatures indicated by said packets delivered to said sensors; delivering packets indicating a composite signature to an analyzer; detecting a composite signature delivered to said analyzer; using the results of said detecting steps to determine unauthorized access to said network.
Claim 32
Dependent Claim
84 words
An intrusion detection system for use with a network router that delivers traffic to a local network, comprising: a plurality of intrusion detection sensors connected to a communications link between said router and said local network, each said sensor operable to operate in parallel to perform signature analysis on packet traffic distributed by said router to said sensors on a packet-based level; and an analyzer operable to receive packets indicating a composite signature and to detect a composite signature indicated by said packets received.
Claim 33
Dependent Claim
84 words
An intrusion detection system for use with a network router that delivers traffic to a local network, comprising: a plurality of intrusion detection sensors connected to a communications link between said router and said local network, each said sensor operable to operate in parallel to perform signature analysis on packet traffic distributed by said router to said sensors on a packet-based level; and an analyzer operable to receive packets indicating a composite signature and to detect a composite signature indicated by said packets received.
Claim 34
Dependent Claim
78 words
A switch for providing intrusion detection for switched network traffic, the switch comprising: a plurality of intrusion detection sensors integrated within said switch, each said sensor operable to operate in parallel to perform signature analysis on packet traffic distributed within said switch; a load balancing unit for distributing packets on a packet-based level to said sensors; and an analyzer operable to receive packets indicating a composite signature and to detect a composite signature indicated by said packets received.
Claim 35
Dependent Claim
78 words
A switch for providing intrusion detection for switched network traffic, the switch comprising: a plurality of intrusion detection sensors integrated within said switch, each said sensor operable to operate in parallel to perform signature analysis on packet traffic distributed within said switch; a load balancing unit for distributing packets on a packet-based level to said sensors; and an analyzer operable to receive packets indicating a composite signature and to detect a composite signature indicated by said packets received.
Claim 36
Dependent Claim
107 words
A switch for providing intrusion detection for switched network traffic, the switch comprising: a plurality of intrusion detection sensors integrated within said switch, each said sensor operable to operate in parallel to perform signature analysis on packet traffic distributed within said switch; an arbitration bus linking each said sensor for communicating arbitration control signals among said sensors, said arbitration control signals operable to distribute packets to said sensors on a packet-based level; an arbitration circuit associated with each said sensor for generating said arbitration signals; and an analyzer operable to receive packets indicating a composite signature and to detect a composite signature indicated by said packets received.
Claim 37
Dependent Claim
107 words
A switch for providing intrusion detection for switched network traffic, the switch comprising: a plurality of intrusion detection sensors integrated within said switch, each said sensor operable to operate in parallel to perform signature analysis on packet traffic distributed within said switch; an arbitration bus linking each said sensor for communicating arbitration control signals among said sensors, said arbitration control signals operable to distribute packets to said sensors on a packet-based level; an arbitration circuit associated with each said sensor for generating said arbitration signals; and an analyzer operable to receive packets indicating a composite signature and to detect a composite signature indicated by said packets received.
References Cited (Backward Citations)
US5101402A
Cited
US5032979A
Cited
US5278901A
Cited
US5493689A
Cited
US5621889A
Cited
US5448724A
Cited
US5414833A
Cited
US5606668A
Cited
US5557742A
Cited
US5524238A
Cited
US5488715A
Cited
US5699513A
Cited
US5568471A
Cited
US5793763A
Cited
US5826014A
Cited
US5931946A
Cited
US5918021A
Cited
US5798706A
Cited
US5774660A
Cited
US5991881A
Cited
US5796942A
Cited
US5805801A
Cited
US5958009A
Cited
US5919257A
Cited
US6167538A
Cited
US6279113B1
Cited
US6088796A
Cited
US6321338B1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2006-06-09 | 2006-12-09 | 2007-06-10 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2010-06-09 | 2010-12-09 | 2011-06-10 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2014-06-09 | 2014-12-09 | 2015-06-10 | $7700.00 | Window Closed / Lapsed |