Daniel J Wyschogrod, 6828 Judith Rd, Newton, MA 02459

6856981, Feb 15, 2005

Dec 3, 2001

10/005462

Daniel Wyschogrod - Newton MA, US
Alain Arnaud - Newton MA, US
David Eric Berman Lees - Lexington MA, US
Leonid Leibman - Weston MA, US

SafeNet, Inc. - Belcamp MD

G06F017/00

706 48

A system and method in accordance with the present invention determines in real-time the portions of a set of characters from a data or character stream which satisfies one or more predetermined regular expressions. A eal-time eterministic inite state utomaton (RDFA) ensures that the set of characters is processed at high speeds with relatively small memory requirements. An optimized state machine models the regular expression(s) and state related alphabet lookup and next state tables are generated. Characters from the data stream are processed in parallel using the alphabet lookup and next state tables, to determine whether to transition to a next state or a terminal state, until the regular expression is satisfied or processing is terminated. Additional means may be implemented to determine a next action from satisfaction of the regular expression.

7305391, Dec 4, 2007

Feb 6, 2004

10/773595

Daniel Wyschogrod - Newton MA, US
Leonid Leibman - Weston MA, US

SafeNet, Inc. - Belcamp MD

G06F 7/00

707 6

A method for determining the start of a match of a regular expression using the special state table, the set of start state registers and the DFA next state table, includes the step of determining from the regular expression each start-of-match start state and each end-of-match terminal state. For each start state, a start state entry is loaded into the special state table. For each terminal state, a terminal state entry is loaded into each special state table. The next state table is used to return the next state from the current state and an input character. When a start state is encountered, the current offset from the beginning of the input character string is loaded into the start state register. When a terminal state is encountered, the terminal state entry is retrieved from the special state table, and the value of the start state register corresponding to the rule number of the terminal entry in the special state table is further retrieved. The value of the start state register which is retrieved indicates the location in the character string where the start-of-match occurred for a particular rule.

7461370, Dec 2, 2008

Feb 7, 2003

10/359839

Daniel Wyschogrod - Newton MA, US
Leonid Leibman - Weston MA, US

SafeNet, Inc. - Belcamp MD

G06F 9/45

717144, 717142, 717143, 717154

A system for processing regular expressions containing one or more sub-expressions. Information regarding one or more regular expressions, each containing one or more sub-expressions, is stored. Data is compared to the stored information regarding expressions in only a single pass through the data. From the comparison, for any stored expression, the location within the data of the beginning and end of each sub-expression, and the end of the regular expression, are determined. From such determination, the presence within the data of any one or more stored regular expressions containing one or more sub-expressions is identified.

2003006, Apr 3, 2003

Aug 8, 2002

10/217592

Daniel Wyschogrod - Newton MA, US
Alain Arnaud - Newton MA, US
David Lees - Lexington MA, US
Leonid Leibman - Weston MA, US

Raqia Networks Inc. - Newton MA

G06F015/173
G06F015/16

709/230000, 709/238000

A method for generating look-up tables for a high speed multi-bit Real-time Deterministic Finite state Automaton (hereinafter RDFA). The method begins with a DFA generated in accordance with the prior art. For each state in the DFA, and for each of the bytes recognized in parallel the following occurs. First an n-closure list is generated. An n-closure list is a list of states reachable in n-transitions from the current state. Next an alphabet transition list is generated for each state. An “alphabet transition list” is a list of the transitions out of a particular state for each of the characters in an alphabet. Finally, the transitions are grouped into classes. That is, the transitions that go to the same state are grouped into the same class. Each class is used to identify the next state. The result is a state machine that has less states than the original DFA.

2003011, Jun 12, 2003

Jan 24, 2003

10/350540

Daniel Wyschogrod - Newton MA, US
Alain Arnaud - Newton MA, US
David Lees - Lexington MA, US

Raqia Networks, Inc. - Newton MA

G06F015/16

709/202000

Data that spans multiple packets is processes. A finite state machine is used to process the data in each packet and the “state” of a finite state machine is saved after processing a packet. The saved state is stored with information that identifies the particular data stream from which the packet originated. This means that a state machine engine (hardware implementation of the finite state machine) is not tied to a particular data stream. The present invention makes it possible to utilize state machine co-processors very efficiently in a multiple engine/multiple data stream system.

2008007, Mar 27, 2008

Sep 18, 2007

11/901515

Daniel Wyschogrod - Newton MA, US
Leonid Leibman - Weston MA, US

G06F 7/06
G06F 17/30

707006000, 707E17014

A system for determining the start of a match of a regular expression has a special state table which contains start state entries and terminal state entries; a plurality of start state registers for storing offset information indicative of the start of a match of the regular expression; a deterministic finite state automaton (DFA) next state table which, given the current state and an input character, returns the next state. The DFA next state table includes a settable indicator for any next state table entry which indicates whether to perform a lookup into the special state table. A compiler loads values into the special state table based on the regular expression.

2012005, Mar 1, 2012

Sep 1, 2010

12/873553

Daniel Wyschogrod - Newton MA, US
David Patrick Mankins - Cambridge MA, US

RAYTHEON BBN TECHNOLOGIES CORP. - Cambridge MA

G06F 21/20

726 22

Systems and methods are disclosed for detecting covert DNS tunnels using n-grams. The majority of legitimate DNS requests originate from network content itself, for example, through hyperlinks in websites. So, comparing data from incoming network communications to a hostname included in a DNS request can give an indication on whether the DNS request is a legitimate request or associated with a covert DNS tunnel. This process can be made computationally efficient by extracting n-grams from incoming network content and storing the n-grams in an efficient data structure, such as a Bloom filter. The stored n-grams are compared with n-grams extracted from outgoing DNS requests. If n-grams from an outgoing DNS request are not found in the data structure, the domain associated with the DNS request is determined to be associated with a suspected covert DNS tunnel.

2014005, Feb 27, 2014

Aug 23, 2012

13/592596

Daniel Wyschogrod - Newton MA, US
Steven W. Jilcott - Foxboro MA, US
Jonathan Aron Rubin - Bedford MA, US
John O. Everett - Great Falls VA, US

Raytheon BBN Technologies Corp. - Cambridge MA

G06F 21/00

726 23

Embodiments of a system and method for computer inspection of information objects, for example, executable software applications for common components that may include elements of computer viruses, items from hacker exploit libraries, or other malware components. Information objects may contain identified sequences of instructions, each of which may be identified and hierarchically grouped based on their structural relationship(s). In the software context, programming languages may include multiple components that include functional code; these components are often shared between programmers. In some embodiments, an inspection of the hierarchical relationship of components (e.g., constituent functions) in the information objects may allow for identification of common components shared between programs. In some embodiments, authorship of objects or components in the objects may be identified by comparisons between component samples. In some embodiments, inspection of the relationship between components is limited to component groups having a specified structural size, complexity, or eccentricity.