Using regexp's To Search IDS Data -- Patented

MiniGhost writes "Well... the USPTO is at it again! A recent search of their online patent database reveals a new patent issued on Nov 26, 2002. Apparently cisco has been issued patent #6,487,666, titled 'Intrusion detection signature analysis using regular expressions and logical operators.' So now they are claiming patent rights on the use of regular expressions and logical operators for IDS usage. It's only a matter of time before some corporation patents the stick man now!!"

Comments

New National Motto!

[unterderbrucke]

"The Nation of No Common Sense (whatsoever)"

Re:New National Motto!

[k_stamour]

Is it me or is Cisco becoming MS like? Also, what other non-Cisco IDS systems might this effect? (financially/Legally)

Re:New National Motto!

[invenustus]

ngrep and every program that uses it come to mind.

So

[CableModemSniper]

this must be why the slashdot search sucks so much. They can't use regexprs to do it!

Re:So

[Anonymous Coward]

you hafta order by score not by date

Re:So

[TerryAtWork]

Its not /. search that sucks so much as SourceForge....

Stick man?

[jeffy124]

+-----+
| \o/ |
| | |
| - |
| / \ |
+-----+

Ha! How 'bout a stick man in a box! Sure beats having to deal with the lameness filter, AND I can now claim prior art whenever the need arises.

Re:Stick man?

[Lord Bitman]

"ZzzzzzzZzzzzz" is hit by the lameness filter and a stick man in a box gets through? BOOOooo!

Re:Stick man?

[gwynnebaer]

That's strange, I see a cyclops with a long nose, closed lips, and a goatee. Maybe I can patent it both ways and say it's different.

Cisco is a bunch of weasels

[LWolenczak]

I'm sorry... but I know there is prior art...... I wrote some stuff using grep four years ago to sift through packets that had set off portsentry. Seriously.... I have a book I got about six months ago... I think its a CERT book... I don't really remember, but it discusses doing that kind of stuff. I wonder what cisco is going to try to do with all this? Hit the linux ids developing people with a DMCA violation/suit or some crazy shit like that? It will only make sense because linux is getting to be way more powerful then pix.

I wonder how cisco plans to abuse this patent... besides... lets start collecting prior art so the patent can be challenged...

And there will be Joy...

Re:Cisco is a bunch of weasels

[MiniGhost]

One would really wonder if they even will. I mean regular expressions have been used for parsing log files for decades. It's nothing new. And I know have been used for quite a while as well.

Pay attention...

[Anonymous Coward]

...to the fact that the id# ends with the number of the beast! Evil!

Jurassic Grep

[4of12]

Hmmm...patents on search technology...hmmm...

Do you think I could patent the same technology that the USPTO uses to search patents?

I'd love to have them pay me royalties on the use of "a technology for the search of patents by persons looking through paper or microfilm or computer indexed catalogs of all patents".

Really, though. With all the backlog and what not, what would happen if one of the IT persons at the USPTO came up with an innovative idea for searching patents? Suppose a company did?

[I've been developing a patent searching tool lately that I call grep in case you were wondering.]

Re:Jurassic Grep

[Anonymous Coward]

they're a government agency, the patent wouldn't apply to them unless a seperate company licenses the technology.

Not quite...

[malakai]

So now they are claiming patent rights on the use of regular expressions and logical operators for IDS usage.

That's not the patent. If you read the patent, what they've done is created an abstraction for describing intrusion signatures, and integrated this into regulara and logical expressions. What they are really patenting are the new regular expression identifiers used to reprsent their pre-determined "signature events". This boils down to packet types, sequence of packet types, and other specific events they deem necessary to identify an intrusion. These events and the "view" at which they look at the sequence of packets is what's so key to this patent.

They could have hooked this into SQL like experssion, and patented it as extension objects to SQL. But Regular expressions obviously work much better.

This is a rather simple, yet great, idea. It should have been done before, yet it wasn't. Kudos to the people who thought about, and imo, they deserve a patent on it.

They are _not_ patenting Regular Expressions or Regular Experssion that run against packet data. Again, it's the fudemental "signature" events they are patenting. Much like a new programming language patenting some proprietary classes.

-malakai

Re:Not quite...

[Twirlip of the Mists]

I'm glad there are still people out there who evaluate the merits of patents based on reading them, rather than based merely on the titles. Bravo.

You, sir, just made my friends list.

Re:Not quite...

[MeanMF]

This really does sound like a good way to build attack signatures into your intrusion detection system. It makes the task of creating and adding new signatures much easier. Too bad Cisco had to come up with it... Their software is generally a real pain in the ass to deal with.

Re:Not quite...

[MacAndrew]

Thank you also! Sometimes a surface reading is highly misleading, or a misinterpretation easy to make. I'll look for more on this. (I guess I, too, could read the patent, but that's too much like work.)

In the spirit of Slashdot I do have to say you are an fscking moron of questionable parentage -- but you understand it's nothing personal. :)

Re:Not quite...

[Yuan-Lung]

I am glad to know that... what would the world be like if a man can't grep his log without wihout paying a loyalty?

Re:Not quite...

[miu]

They are _not_ patenting Regular Expressions or Regular Experssion that run against packet data. Again, it's the fudemental "signature" events they are patenting. Much like a new programming language patenting some proprietary classes.

I've used packet content and state signatures to generate events for proxies or FSM transitions for quite some time. A match-event pairing seems a natural way to achieve this.

I agree it is not like they are patenting 'grep', but this is a new application of an old idea, rather than a new idea.

Re:Not quite...

[Anonymous Coward]

They patented the idea of giving names (sorry, "signatures") to regexps or groups of regexps. It was done before.

Patenting programming classes is beyond what the patent office have ever done.

Re:Not quite...

[Alsee]

I read the patent and I am a programmer. I am not a patent lawyer nor an IDS specialist. If there is something actually new and interesting that I missed, someone PLEASE tell me. It was a pain trying to read it, and it looks like total crap to me.

As far as I can tell the patent is on combining regular expressions with logical operators.

RedEx(packet_looks_suspicious) AND NOT RexEx(good_packet_that_somtimes_looks_supicious)

This is absurd. RegEx's are a basic to IDS. Programming is little more than combining things with logical operators. They elaborate with further claims on doing this in MEMORY (what a novel concept!) and using it to control a PROGRAM (Holy innovations Batman!).

I guarantee that regular expressions have been combined with logical operators a million times before, and I'd be shocked if it has never been used IDS before.

-

Re:Not quite...

[Alsee]

Just clearing up a double typo:

RegEx(packet_looks_suspicious) AND NOT RegEx(good_packet_that_somtimes_looks_supicious)

I meant RegEx - regular expressions.

-

Shhhhh!

[Anonymous Coward]

It's only a matter of time before some corporation patents the stick man now!!

Quit giving them obvious ideas!!

Patent Schmatent.

[immanis]

Cisco can have my regexps when they pry then from my cold, dead hands.

Wait, I have carpal.

Cisco can have my regexps when they pry then from my dead hands.

Grep, Awk, some Shell and /var/log/*

[jsimon12]

Hmmm, from what I read if I write a shell script that uses grep, awk and maybe a little sed to hash my /var/log directory I am in violation of their patent?!?!?!?! Give me a break, as stated before the USPTO needs a massive overhaul, not to mention someone needs to question the ethics of those who patent common procedures.

I'm off to file a patent form...

[jpsst34]

...for the most widely used thing in the world. If an action can be patented, and it can, then I aim to patent masturbation - in all forms - male, female, mutual, etc. Everybody does it. Those who admit will have to pay royalties to me, and those who don't admit it will be sued because they are liars and are not paying royalties.

1. patent masturbation
2. hope porn sites exist on the internet
3. wait...
4. wait...
5. not yet!
6. just a minute
7. Profit!!!!!!!!


Ahhhh. Now give me royalties.

stick man

[Pentagon13]

only a matter of time before some corporation patents the stick man now!

I believe Roger Myers already has the copyright on the stick man, except he called it Manic Mailman.

THE SUBMISSION IS NOT ACCURATE...

[shaitand]

If you read the patent that is linked they are not patenting the use of regular expressions in any way shape or form. They have a patent on searching technology "similar" to regular expressions.

Re:THE SUBMISSION IS NOT ACCURATE...

[mhesseltine]

You're kind of new here aren't you. This is par for the course. Welcome to /.

Shennanigans!

[Anonymous Coward]

I think it's about time for everybody to declare Shennanigans! on IP patents. You know what? Ideas aren't very hard to come up with you know. In fact, all it requires is thinking, which is what the human brain does in its spare time. In fact, the term "Intellectual Property" seems to be an oxymoron. Property implies ownership, and just because you thought of it first doesn't mean you own an idea. As soon as you've let that idea escape your little noggin (And don't fool yourself: Your brain is miniscule. Tiny in fact, compared to the lump of rock that it's sitting on), it's no longer yours! Somebody else's brain has interpreted it, and now has its own version of it. Gah! I'm fed up with money-grubbing corporations.

Bwahahahahaha

[__aafkqj3628]

Don't worry, I'll get to that stick man first!!!

I'm curious though, does this US patent effect me in New Zealand?

Re:Bwahahahahaha

[meowsqueak]

I can't speak for this particular patent, but a US patent will only affect you if you are operating within the US jurisdiction (for example exporting goods to the USA). US patents generally will not affect you in NZ unless they have taken out a patent there also.

My understanding is that there is no such thing as a 'global' patent - you have to register your invention in every country you have an interest in. It gets quite costly.

oops..

[zoloto]

you typed all that with one hand? damn you're good!

no, i don't mb either :P

Question:

[Hubert_Shrump]

Do they have a patent on ^s.*ing$ my ^[dc].*k$ ?

Re:Question:

[Lord Bitman]

"simultaneously handling multiple objects for use in developing
chemical substitutes for products commonly used to cook"?
No...

Maybe you mean "^s\w+ing$" my "[dc]\w+k$"? But that doesnt make sense... why would they want a patent on stewing your duck?

Re:Question:

[Hubert_Shrump]

It's a pretty important duck. Or at least, that is what he'd have be believe.

But nonetheless, as soon as this is resolved, he gets the pot.

really now

[spikedvodka]

READ THE DAMN PATENT!
(yes, I know that you'll need to copy the patent number into the seach box, becuase the link is wrong, or just Use the link provided here)

Now also, they aren't pattenting the use of regexps in searching logs, they're pattenting the use of Regexps in conjunction with logical operations in **Generating** alerts. What i'd be interested in seeing is how this impacts of what snort is doing, and has been doing for quite some time now.

Re:really now

[idontgno]

Thanks for the link. The patent itself seems, to me, to be both interesting, and not novel. It doesn't seem to be a threat to using REs in most contexts, either, for all you awk/grep/perl freaks (my brothas!) out there.

But signature REs and logical expressions? Most signature-based stream matching works that way. Antivirus, pre-existing IDS, even (as many have pointed out) most perl log-analysis tools. I suspect that this should wither at the first touch of prior art. Assuming someone with more courage than money gets to be the lucky first victim.

Hmmm... I can't recall right away. What's Cisco's general history with repect to IP issues? Something about U-Cal-Berkeley copyrights comes to mind for some reason...

Re:really now

[Black Copter Control]

What i'd be interested in seeing is how this impacts of what snort is doing, and has been doing for quite some time now.

If it does, then snort is the prior art. The more specific requirements are: using regexpreessions to identify

• a packet type.
• a sequence of packets.
• a signature-related event.

The last two claims entail compiling the ruleset and keeping it in memory. If snort does all of this (I think it does), then the next questions are:

1: was it done before Jan 15, 2002, or was the possibility of doing so done (publicly) before Jan 15, 2002? If that occured, then Snort (or the snort mailing list where the possibility was explored) would be the prior art that eats this patent.

Yes, discussing the possibility counts as prior art. The best example of that was when the patent for waterbeds was wiped out by Heinlien's description in "Stranger in a Strange Land".

it's worse than the poster thought...

[Anonymous Coward]

They patented using a lexer/parser state machine combo to detect [network] events. Where's the innovation? This is insulting.

The above examples use various identifiers and logical symbols to illustrate the use of regular expressions and logical operators. It should be understood that any other type of "token", such as those already familiar to computer programmers, could be used. These additional tokens include a vast variety of reserved words, numerical constants, strings, and punctuation.

The use of regular expressions to represent signatures permits a compiler or other lexical analyzer to be written. In general, a process can be written for both recognizing and evaluating the above-described identifiers, special symbols, or other tokens.

Hello? Please tell me they didn't realize they were trying to patent using flex/bison.

Crappy moderators! That's FUNNY!

[cryofan2]

it's not flamebait--it's funny!

It is a pretty broad patent...

[parabyte]

To find out what a patent is about and who will be affected, you have to read the first claim, find possibly other independet claims and ask yourself what kind of system will have all of these properties mentioned in one of these independent claims.

In this particular case you have just four criterias in claim 1, and the are pretty unspecific, so it it is a patent possibly dangerous to many people. There are two additional independent claims 4 and 7, which you can view as different additional claims that were put into the patent to widen it's scope. The rest of the patent just clarifies and specializes these independent claims.

It is the examiner's job to narrow the claims as much as possible, and the applicant usually want to have them as wide as possible. Here, definitely the applicants did a better job than the examiner.

From what I see, there is no real invention here, but that is true for most of the so called IT-Patents, and this one is not a particularly bad example, it is merely a typical patent you often have to write because the competition does it too.

p.