ADAPTIVE CONTENT INSPECTION
Methods and apparatus are provided involving adaptive content inspection. In one embodiment, a content inspection processor may identify information with respect to input data and provide the information to a host controller. The host controller may adapt search criteria or other parameters and provide the adapted parameter to the content inspection processor. Other embodiments may include a content inspection processor having integrated feedback, such that results data is fed back to the content inspection processor. The results data may be processed before being provided to the content inspection processor.
This application is a continuation of U.S. patent application Ser. No. 15/618,935 filed Jun. 9, 2017, which is a continuation of U.S. patent application Ser. No. 13/928,171 filed Jun. 26, 2013, which is a continuation of U.S. patent application Ser. No. 12/638,767 filed Dec. 15, 2009, each of which is incorporated herein by reference in its entirety for all purposes.
BACKGROUND Field of InventionEmbodiments of the invention relate generally to content inspection processors, and, more specifically, to programming and operation of such processors.
Description of Related ArtIn the field of computing, content inspection tasks are increasingly challenging. For example, pattern-recognition, a subset of content inspection tasks, may become more challenging to implement because of larger volumes of data and the number of patterns that users wish to identify. For example, spam or malware are often detected by searching for content, e.g., patterns in a data stream, such as particular phrases or pieces of code. The number of patterns increases with the variety of spam and malware, as new patterns may be implemented to search for new variants. Searching a data stream for each of these patterns can form a computing bottleneck. Often, as the data stream is received, it is searched for each pattern, one at a time. The delay before the system is ready to search the next portion of the data stream increases with the number of patterns. Thus, content inspection may slow the receipt of data.
Further, in many pattern recognitions, searches, or other content inspection tasks, the content inspection process is performed using (e.g., according to, against, with respect to, etc.) a fixed and defined set of search criteria. The device performing the content inspection process does not adjust to changes in input data and/or results data.
The apparatus 10 may also include a content inspection processor 14. The content inspection processor 14 may be one or more processors configured to inspect data using search criteria. For example, the content inspection processor 14 may be capable of using search criteria to match a pattern in a data set or a data stream provided to the content inspection processor 14. The content inspection processor 14 may be coupled to and controlled by processing logic, such as a host controller 16 that communicates with the content inspection processor 14 over one or more buses. The host controller 16 may program the content inspection processor 14 with search criteria or any other parameters used by the content inspection processor 14 during operation. The content inspection processor 14 may provide the primary or secondary functions of the apparatus 10. In one embodiment, the content inspection processor 14 may be a pattern-recognition processor as described in U.S. patent application Ser. No. 12/350,132.
The apparatus 10 typically includes a power supply 18. For instance, if the apparatus 10 is a portable system, the power supply 18 may advantageously include permanent batteries, replaceable batteries, and/or rechargeable batteries. The power supply 18 may also include an AC adapter, so the apparatus 10 may be plugged into a wall outlet, for instance. The power supply 18 may also include a DC adapter such that the apparatus 10 may be plugged into a vehicle cigarette lighter, for instance.
Various other devices may be coupled to the processor 12, depending on the functions that the apparatus 10 performs. For instance, an input device 20 may be coupled to the processor 12. The input device 20 may include buttons, switches, a keyboard, a light pen, a stylus, a mouse, and/or a voice recognition system, for instance. A display 22 may also be coupled to the processor 12. The display 22 may include an LCD, a CRT, LEDs, and/or any other suitable display, for example.
Furthermore, an RF sub-system/baseband processor 24 may also be coupled to the processor 12. The RF sub-system/baseband processor 24 may include an antenna that is coupled to an RF receiver and to an RF transmitter (not shown). A communications port 26 may also be coupled to the processor 12. The communications port 26 may be adapted to be coupled to one or more peripheral devices 28 such as a modem, a printer, a computer, or to a network, such as a local area network, remote area network, intranet, or the Internet, for instance.
Generally, memory is coupled to the processor 12 to store and facilitate execution of various programs. For instance, the processor 12 may be coupled to system memory 30 through a memory controller 32. The system memory 30 may include volatile memory, such as Dynamic Random Access Memory (DRAM) and/or Static Random Access Memory (SRAM). The system memory 30 may also include non-volatile memory, such as read-only memory (ROM), flash memory of various architectures (e.g., NAND memory, NOR memory, etc.), to be used in conjunction with the volatile memory. Additionally, the apparatus 10 may include a hard drive 34, such as a magnetic storage device.
The program bus 36 transfers programming data from the host controller 16 to the content inspection processor 14. This program data is used to program the content inspection processor 14, with the operating parameters used during the inspection process. For example, in one embodiment the programming data may include search criteria (e.g., patterns or other criteria of interest) used by the content inspection processor 14, to match to the input data received over the input bus 38. The search criteria may include one or more patterns of any length and complexity.
The output of the content inspection processor 14 may be transferred over a results bus 40. The results bus 40 may provide the results data (e.g., search results) from processing of the input data by the content inspection processor 14 to the host controller 16. For example, in some embodiments the results data provided over the results bus 40 may indicate a match, may indicate “no match,” and may include the particular search criteria that were matched and/or the location in the input data where the match occurred. In some embodiments, the content inspection processor 14 may notify the host controller 16 of any specific results data by transferring an output over the results bus 40.
In some embodiments, the input bus 38, program bus 36, and results bus 40 may be physically distinct buses, or any combination of the input bus 38, program bus 36, and results bus 40 may be physically implemented on a single bus interface. For example, in such an embodiment the single bus interface may be multiplexed or controlled via any suitable technique to transmit the different types of data provided to and received from the content inspection processor 14.
For example,
The content inspection processor 14 may be programmed with search criteria to identify information with respect to the input data, such as by matching certain characteristics of the input data using the search criteria. Further, the content inspection processor 14 may be programmed with the search criteria based on the function of the content inspection processor 14 (e.g., natural language translation, network firewall, etc.) Thus, in an embodiment providing natural language translation, the content inspection processor 14 may be programmed to identify the natural language of the incoming input data 60. In such an embodiment, the content inspection processor 14 may not have enough memory to store all of the search criteria for each type of input data 60 (e.g., each possible natural language). After the input data 60 has been identified, the identity may be provided to the host controller 16 over the results bus 40. The host controller 16 may then adapt the search criteria based on the identity of the input data 60 and program the content inspection processor 14 with adapted search criteria for that specifically identified type of input data. For example, if the input data is identified as English, the search criteria may be adapted to match patterns of interest in English.
Further, any number of levels of adaptability may be provided by the content inspection processor 14. For example,
In other embodiments, the identification of the input data may be used to enhance network security. For example, the content inspection processor 14 may identify code fragments in the input data that correspond to code fragments commonly found in close proximity to signatures of attack viruses, worms, or other malware. After such code fragments are identified, the host controller 16 may adapt the search criteria to match the attack signature known to be associated with such code fragments. These adapted search criteria may be provided to the content inspection processor 14 so that the content inspection processor 14 is better able to search for the respective attack signature associated with those code fragments, increasing accuracy of the inspection process.
In other embodiments, the identifying information searched for in the input data may be a network protocol, such as hypertext transfer protocol (HTTP), file transfer protocol (FTP), DNS request, etc. By identifying the protocol and providing this identity to the host controller 16, the host controller 16 may adapt search criteria for a specific protocol and program the content inspection processor 14 accordingly. In other embodiments, the identifying information (e.g., identity) searched for may be encoding/decoding information of the input data, where the identifying information of the input data is fed back to an encoder or decoder to adjust the encoding or decoding process. For example, a video or other media encoder may use the content inspection processor 14 to inspect the output of the encoding process and provide feedback to the encoder to enable the encoder to dynamically adapt the encoding process. In yet other embodiments, the identifying information may be any digitally encoded information.
In other embodiments, the content inspection processor 14 may include feedback mechanisms to provide dynamic adaptability to the content inspection processor 14 based on the input data.
In other embodiments, the feedback loop may include additional post-results processing.
Claims
1. An electronic apparatus, comprising:
- a content inspection processor configured to inspect input data using a first search criteria to determine first result data indicative of a higher level identifying characteristic of the input data; and
- a host controller communicatively coupled to the content inspection processor, wherein the host controller is configured to: determine a second search criteria based at least in part on the higher level identifying characteristic of the input data indicated in the first result data; and program the content inspection processor to inspect the input data using the second search criteria to enable the content inspection to determine a lower level identifying characteristic of the input data.
2. The electronic apparatus of claim 1, wherein:
- the content inspection processor configured to: inspect the input data using the first search criteria to detect whether a first code fragment associated with a first one or more attack signatures is present in the input data; and output the first result data to indicate whether the first code fragment is detected in the input data; and
- the host controller is configured to, when the first result data indicates that the first code fragment is detected in the input data: determine the second search criteria based on the first one or more attack signatures associated with the first code fragment; and program the content inspection processor to inspect the input data using the second search criteria to enable the electronic apparatus to detect whether malware is present in the input data.
3. The electronic apparatus of claim 2, wherein:
- the content inspection processor configured to: inspect the input data using the first search criteria to detect whether a second code fragment associated with a second one or more attack signatures is present in the input data; and output the first result data to indicate whether the second code fragment is detected in the input data; and
- the host controller is configured to, when the first result data indicates that the second code fragment is detected in the input data: determine the second search criteria based on the second one or more attack signatures associated with the second code fragment; and program the content inspection processor to inspect the input data using the second search criteria to enable the electronic apparatus to detect whether malware is present in the input data.
4. The electronic apparatus of claim 1, wherein
- the content inspection processor configured to: inspect the input data using the first search criteria to determine a natural language of the input data; and output the first result data to indicate the natural language of the input data; and
- the host controller is configured to: determine the second search criteria based at least in part on a language pattern used in the natural language of the input data; and program the content inspection processor to inspect the input data using the second search criteria to enable the electronic apparatus to translate the natural language of the input data into a different language.
5. The electronic apparatus of claim 4, wherein the content inspection processor is configured to:
- inspect the input data using the second search criteria to detect presence of the language pattern in the input data; and
- output second result data indicative of whether the language pattern is detected in the input data and, when the language pattern is detected in the input data, location of the language pattern in the input data to enable the electronic apparatus to translate the language pattern from the natural language of the input data into the different language.
6. The electronic apparatus of claim 5, wherein:
- the language pattern is used in a regional dialect of the natural language of the input data; and
- the electronic apparatus is configured to detect that the input data uses the regional dialect when the second result data indicates that the language pattern is detected in the input data.
7. The electronic apparatus of claim 1, comprising a communication port configured to communicatively couple the electronic apparatus to a communication network, wherein:
- the electronic apparatus is configured to receive the input data from the communication network via the communication port; and
- the content inspection processor is configured to: inspect the input data using the first search criteria to determine a network protocol used by the communication network; and output the first result data to indicate the network protocol used by the communication network.
8. The electronic apparatus of claim 1, wherein the input data inspected by the content inspection processor comprises encoded image data output from a video encoder.
9. The electronic apparatus of claim 1, wherein the electronic apparatus comprises a computer, a pager, a cellular phone, a personal organizer, a portable audio player, a network router, a network firewall, or a network switch.
10. A method of operating an electronic apparatus comprising:
- inspecting, using the electronic apparatus, received data using a first search criteria to determine first result data indicative of a higher level identifying characteristic of the received data;
- determining, using the electronic apparatus, a second search criteria based at least in part on the higher level identifying characteristic of the received data indicated in the first result data; and
- re-inspecting, using the electronic apparatus, the received data using the second search criteria to enable the electronic apparatus to determine a lower level identifying characteristic of the input data encompassed by the higher level identifying characteristics of the received data.
11. The method of claim 10, wherein:
- inspecting the received data comprises: inspecting the received data using the first search criteria to determine a natural language of the received data; and determining the first result data to indicate the natural language of the received data;
- determining the second search criteria comprises determining the second search criteria based at least in part on a language pattern used in the natural language of the received data; and
- re-inspecting the received data comprises re-inspecting the received data using the second search criteria to enable the electronic apparatus to translate the natural language of the received data into a different language.
12. The method of claim 11, wherein re-inspecting the received data comprises:
- re-inspecting the received data using the second search criteria to detect presence of the language pattern in the received data; and
- determining second result data indicative of whether the language pattern is detected in the received data and, when the language pattern is detected in the received data, location of the language pattern in the received data to enable the electronic apparatus to translate the language pattern from the natural language of the received data into the different language.
13. The method of claim 10, comprising receiving the received data from a communicating network communicatively coupled to the electronic apparatus via a communication port, wherein inspecting the received data comprises:
- inspecting the received data using the first search criteria to determine a network protocol used by the communication network; and
- determining the first result data to indicate the network protocol used by the communication network.
14. The method of claim 10, wherein:
- inspecting the received data comprises: inspecting the received data using the first search criteria to determine whether a code fragment associated with one or more attack signatures is present in the received data; and determining the first result data to indicate whether the code fragment is detected in the received data; and
- when the first result data indicates that the code fragment is detected in the received data: determining the second search criteria comprises determining the second search criteria based on the one or more attack signatures associated with the code fragment; and re-inspecting the received data comprises re-inspecting the received data using the second search criteria to enable the electronic apparatus to detect whether malware is present in the received data.
15. The method of claim 14, comprising:
- executing, using the electronic apparatus, the received data when re-inspection of the received data using the second search criteria determines that malware is not present in the received data; and
- disregarding, using the electronic apparatus, the received data when the re-inspection of the received data using the second search criteria determines that malware is present in the received data.
16. A network device comprising:
- a communication port configured to communicatively couple the network device to a communication network to enable the network device to receive input data from the communication network; and
- one or more processors communicatively coupled to the communication port, wherein the one or more processors are programmed to: inspect the input data using a first search criteria to determine first result data indicative of whether a first code fragment associated with a first one or more attack signatures is present in the input data; and when the first result data indicates that the first code fragment is detected in the input data: determine a second search criteria based at least in part on the first one or more attack signatures associated with the first code fragment; and re-inspect the input data using the second search criteria to enable the network device to detect whether malware is present in the input data before execution.
17. The network device of claim 16, wherein the one or more processors are programmed to:
- inspect the input data using a third search criteria before the first search criteria to determine second result data indicative of a network protocol used by the communication network; and
- determine the first search criteria based at least in part on the network protocol indicated in the first result data.
18. The network device of claim 16, wherein the one or more processors are programmed to:
- inspect the input data using the first search criteria to determine the first result data such that the first result data indicates of whether a second code fragment associated with a second one or more attack signatures is present in the input data; and
- determine the second search criteria based at least in part on the second one or more attack signatures associated with the second code fragment when the first result data indicates that the second code fragment is detected in the input data.
19. The network device of claim 16, wherein the one or more processors are programmed to re-inspect the input data using the second search criteria to determine second result data indicative of whether malware is present in the input data.
20. The network device of claim 16, wherein the network device comprises a network router, a network firewall, a network switch, or any combination thereof.
Type: Application
Filed: Feb 20, 2019
Publication Date: Jun 13, 2019
Inventors: Paul D. Dlugosch (Eagle, ID), Harold B Noyes (Boise, ID)
Application Number: 16/280,872