Abstract: An intrusion detection system (IDS) comprises a network processor (NP) coupled to a memory unit for storing programs and data. The NP is also coupled to one or more parallel pattern detection engines (PPDE) which provide high speed parallel detection of patterns in an input data stream. Each PPDE comprises many processing units (PUs) each designed to store intrusion signatures as a sequence of data with selected operation codes. The PUs have configuration registers for selecting modes of pattern recognition. Each PU compares a byte at each clock cycle. If a sequence of bytes from the input pattern match a stored pattern, the identification of the PU detecting the pattern is outputted with any applicable comparison data. By storing intrusion signatures in many parallel PUs, the IDS can process network data at the NP processing speed. PUs may be cascaded to increase intrusion coverage or to detect long intrusion signatures.

Abstract: A remote user, two-way authentication and password change protocol that also allows parties to optionally establish a session key which can be used to protect subsequent communication. In a preferred embodiment, a challenge token is generated and exchanged which is a one-time value that includes a random value that changes from session to session. The construction and use of the challenge token avoids transmission of the password or even the transmission of a digest of the password itself. Thus the challenge token does not reveal any information about a secret password or a digest of the password.

Abstract: The classification system of a network device includes a cache in which a mapping between predefined characteristics of TCP/IP packets and associated actions are stored in response to the first “Frequent Flyer” packet in of a session. Selected characteristics from subsequent received packets of that session are correlated with the predefined characteristics and the stored actions are applied to the received packets if the selected characteristics and the predefined characteristics match, thus reducing the processing required for subsequent packets. The packets selected for caching may be data packets. For mismatched characteristics, the full packet search of the classification system is used to determine the action to apply to the received packet.

Abstract: A detection and response system that generates an Alert if unauthorized scanning is detected on a computer network that includes a look-up table to record state value corresponding to the sequence in which SYN, SYN/ACK and RST packets are observed. A set of algorithms executed on a processing engine adjusts the state value in response to observing the packets. When the state value reaches a predetermined value indicating that all three packets have been seen, the algorithm generates an Alert.

Abstract: A nonrecurrent version of the Neural Network Binary Code Recognizer is disclosed. This Nonrecurrent Binary Code Recognizer, which decodes an input vector of n analog components into a decoded binary word of n bits, comprises an analog-to-digital converter, an inverter circuit, a digital summing circuit and a comparator circuit.

Abstract: A neural network binary code recognizer for decoding n-bit binary code words. This apparatus includes inputs for inputting n signals into the recognizer, each of the n signals representing a bit value of an n-bit binary code word, which may or may not be corrupted. The apparatus also includes n amplifiers, each having an input for receiving a respective input signal. The amplifiers condition the respective input signals to generate respective output signals at one or more bit values of one or more corresponding predetermined valid n-bit binary code words. The apparatus further includes a device for approximating an image product for each of the one or more predetermined valid n-bit binary code words, each approximated image product comprising the product of an output signal from each amplifier in accordance with a respective predetermined valid n-bit binary coded word.

Abstract: An information processing system and method forms a fast optimal or near optimal association based on satisfying global constraints expressed in an association matrix by simulating the behavior of a network of interconnected processing elements resembling neurons in a brain.