US 12,413,609 B2
Anomaly inspection appliance and anomaly inspection method based on correlations of packets
Wen-Yen Tsai, Hsinchu (TW); and Hung-Sheng Huang, Hsinchu (TW)
Assigned to TXONE NETWORKS INC., Hsinchu (TW)
Filed by TXONE NETWORKS INC., Hsinchu (TW)
Filed on Jun. 14, 2023, as Appl. No. 18/210,050.
Prior Publication US 2024/0422182 A1, Dec. 19, 2024
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) [H04L 63/145 (2013.01)] 13 Claims
OG exemplary drawing
 
1. An anomaly inspection appliance based on correlations of packets, comprising:
a first communication channel, configured to transmit a first packet using a first communication protocol;
a second communication channel, configured to transmit a second packet using a second communication protocol;
a storing unit, storing a correlation database, wherein the correlation database records multiple relevant fields of same communication protocol or different communication protocols and a correlation type of each of the relevant fields; and
a processing unit connected with the first communication channel, the second communication channel, and the storing unit, configured to perform a field breakdown procedure to the first packet and the second packet to respectively obtain multiple first packet fields and multiple second packet fields, match one of the multiple first packet fields with one of the multiple second packet fields based on the correlation database to compute a correlation, and issue an alarm when the correlation being computed is unmatched with the correlation type;
wherein the processing unit is configured to execute following actions to establish the correlation database:
transmitting the first packet using the first communication protocol and the second packet using the second communication protocol respectively through the first communication channel and the second communication channel;
performing the field breakdown procedure to the first packet and the second packet to respectively obtain the multiple first packet fields and the multiple second packet fields;
matching, based on a statistical method, artificial intelligent, or machine learning, each of the first packet fields with each of the second packet fields to confirm the correlation of each of the first packet fields and each of the second packet fields and the correlation type of the correlation; and
establishing the correlation database based on the correlation and the correlation type.