High-Performance Network Content Analysis Platform

Abstract

One implementation of a method reassembles complete client-server conversation streams, applies decoders and/or decompressors, and analyzes the resulting data stream using multi-dimensional content profiling and/or weighted keyword-in-context. The method may detect the extrusion of the data, for example, even if the data has been modified from its original form and/or document type. The decoders may also uncover hidden transport mechanisms such as, for example, e-mail attachments. The method may further detect unauthorized (e.g., rogue) encrypted sessions and stop data transfers deemed malicious. The method allows, for example, for building 2 Gbps (Full-Duplex)-capable extrusion prevention machines.

1 .- 10 . (canceled) 
   
   
       11 . A method comprising:
 receiving network communications; and   preventing an unauthorized and/or malicious transfer, through the network communications, of data by providing at least content reassembly, scanning and recognition to the network communications in real time.   
   
   
       12 . The method of  claim 11 , wherein the content scanning and recognition includes multi-dimensional content profiling. 
   
   
       13 . The method of  claim 11 , wherein the content scanning and recognition is tailored to local data. 
   
   
       14 . The method of  claim 11 , wherein the method is capable of preventing the unauthorized and/or malicious transfer, through the network communications, of data on fully saturated Gigabit speeds. 
   
   
       15 - 18 . (canceled) 
   
   
       19 . A machine-readable medium having encoded information, which when read and executed by a machine causes a method comprising:
 receiving network communications; and   preventing an unauthorized and/or malicious transfer, through the network communications, of data by providing at least content reassembly, scanning and recognition to the network communications in real time.   
   
   
       20 .- 21 . (canceled) 
   
   
       22 . An apparatus comprising:
 a receiver to receive network communications; and   a processor, coupled to the receiver, to prevent an unauthorized and/or malicious transfer, through the network communications, of data by providing at least content reassembly, scanning and recognition to the network communications in real time.   
   
   
       23 - 36 . (canceled)