Marc A Norton

Address:

9900 Mcneil Dr APT 6107, Austin, TX 78750

VIN:

3VWAL7AJ2AM124181

Make:

VOLKSWAGEN

Model:

JETTA

Year:

2010

US Patent:

7313695, Dec 25, 2007

Filed:

Mar 23, 2004

Appl. No.:

10/806434

Inventors:

Marc A. Norton - Eldersburg MD, US
Daniel J. Roelker - Arlington VA, US

Assignee:

Sourcefire, Inc. - Columbia MD

International Classification:

G06F 9/00

US Classification:

713166, 713152, 713193

Abstract:

The threat probability of events generated by a security device on a computer network is assessed by comparing the threat probability to a global threat probability. An abstract data type is used to describe how the events are combined to form a threat. If an event matches an unpopulated member of an instance of an abstract data type, the event is added to the instance and the probability of the instance is computed. If the probability of the instance is greater than a global threat probability, a dynamic threat assessment event is generated. A system for dynamically assessing threats to computers and computer networks system includes at least one security device that generates events, an event collection database, policy configuration information, and a dynamic threat assessment engine.

US Patent:

7496962, Feb 24, 2009

Filed:

Sep 29, 2004

Appl. No.:

10/951796

Inventors:

Daniel J. Roelker - Arlington VA, US
Marc A. Norton - Eldersburg MD, US

Assignee:

Sourcefire, Inc. - Columbia MD

International Classification:

G06F 11/00

US Classification:

726 23

Abstract:

A hypertext transport protocol (HTTP) inspection engine for an intrusion detection system (IDS) includes an HTTP policy selection component, a request universal resource identifier (URI) discovery component, and a URI normalization module. The HTTP policy selection component identifies an HTTP intrusion detection policy using a packet. The request URI discovery component locates a URI within the packet. The URI normalization module decodes an obfuscation within the URI. In another embodiment, a packet transmitted on the network is intercepted. The packet is parsed. An Internet protocol (IP) address of the packet is identified. An HTTP intrusion detection policy for a network device is determined. A URI is located in the packet. A pattern from an intrusion detection system rule is compared to the located URI.

US Patent:

7539681, May 26, 2009

Filed:

Jul 26, 2004

Appl. No.:

10/898220

Inventors:

Marc A. Norton - Eldersburg MD, US
Daniel J. Roelker - Arlington VA, US

Assignee:

Sourcefire, Inc. - Columbia MD

International Classification:

G06F 17/30
G06F 7/04

US Classification:

707 9, 707 10, 726 26, 714 48, 714 49

Abstract:

Embodiments of the present invention relate to systems and methods for optimizing and reducing the memory requirements of state machine algorithms in pattern matching applications. Memory requirements of an Aho-Corasick algorithm are reduced in an intrusion detection system by representing the state table as three separate data structures. Memory requirements of an Aho-Corasick algorithm are also reduced by applying a banded-row sparse matrix technique to the state transition table of the state table. The pattern matching performance of the intrusion detection system is improved by performing a case insensitive search, where the characters of the test sequence are converted to uppercase as the characters are read. Testing reveals that state transition tables with sixteen bit elements outperform state transition tables with thirty-two bit elements and do not reduce the functionality of intrusion detection systems using the Aho-Corasick algorithm.

US Patent:

7756885, Jul 13, 2010

Filed:

Apr 19, 2007

Appl. No.:

11/785609

Inventors:

Marc A. Norton - Eldersburg MD, US
Daniel J. Roelker - Arlington VA, US

Assignee:

Sourcefire, Inc. - Columbia MD

International Classification:

G06F 17/30

US Classification:

707758, 707797, 707803, 707809, 707922, 726 13, 726 23

Abstract:

Embodiments of the present invention relate to systems and methods for optimizing and reducing the memory requirements of state machine algorithms in pattern matching applications. Memory requirements of an Aho-Corasick algorithm are reduced in an intrusion detection system by representing the state table as three separate data structures. Memory requirements of an Aho-Corasick algorithm are are also reduced by applying a banded-row sparse matrix technique to the state transition table of the state table. The pattern matching performance of the intrusion detection system is improved by performing a case insensitive search, where the characters of the test sequence are converted to uppercase as the characters are read. Testing reveals that state transition table with sixteen bit elements outperform state transition table with thirty-two bit elements and do not reduce the functionality of intrusion detection systems using the Aho-Corasick algorithm.

US Patent:

8474043, Jun 25, 2013

Filed:

Aug 28, 2008

Appl. No.:

12/230338

Inventors:

Steven Sturges - Ellicott City MD, US
Marc Norton - Eldersburg MD, US

Assignee:

Sourcefire, Inc. - Columbia MD

International Classification:

H04L 29/06

US Classification:

726 23

Abstract:

In an intrusion detection/prevention system, network traffic is received and checked for a matching pattern. Upon identifying the matching pattern, the network traffic with the matching pattern is evaluated against rules that are represented by a rule tree. References to rule options are represented in the rule tree and are stored separately from the rule tree. The rule tree represents unique rules by unique paths from a root of the tree to the leaf nodes, and represents rule options as non-leaf nodes of the rule tree. Evaluating the network traffic includes processing, against the network traffic, the rule options in the rule tree beginning at the root. Processing of the rules represented by subtrees of nodes with rule options that do not match is eliminated. The network traffic is evaluated against rules terminating in leaf nodes only for combinations of rule options that match the network traffic.

US Patent:

7996424, Aug 9, 2011

Filed:

Jan 31, 2008

Appl. No.:

12/010900

Inventors:

Marc A. Norton - Eldersburg MD, US
Daniel J. Roelker - Arlington VA, US

Assignee:

Sourcefire, Inc. - Columbia MD

International Classification:

G06F 7/00
G06F 17/30

US Classification:

707776, 707758, 707803

Abstract:

Embodiments of the present invention relate to systems and methods for optimizing and reducing the memory requirements of state machine algorithms in pattern matching applications. Memory requirements of an Aho-Corasick algorithm are reduced in an intrusion detection system by representing the state table as three separate data structures. Memory requirements of an Aho-Corasick algorithm are also reduced by applying a banded-row sparse matrix technique to the state transition table of the state table. The pattern matching performance of the intrusion detection system is improved by performing a case insensitive search, where the characters of the test sequence are converted to uppercase as the characters are read. Testing reveals that state transition tables with sixteen bit elements outperform state transition tables with thirty-two bit elements and do not reduce the functionality of intrusion detection system using the Aho-Corasick algorithm.

US Patent:

20040205360, Oct 14, 2004

Filed:

Mar 8, 2004

Appl. No.:

10/793887

Inventors:

Marc Norton - Eldersburg MD, US
Daniel Roelker - Arlington VA, US

International Classification:

H04L009/00

US Classification:

713/201000

Abstract:

Performance of an intrusion detection system is enhanced with the addition of rule optimization, set-based rule inspection, and protocol flow analysis. During rule optimization, rule sets are created and selected in such a way that for every incoming packet only a single rule set has to be searched. Set-based rule inspection divides rules into content and non-content type rules. Only search patterns of content type rules are initially compared to a packet. Rules containing matched search patterns are validated with a parameterized search against the packet. Matches are recorded as events. Non-content rules are searched against a packet using a parameterized search. These matches are also recorded as an event. At least one event is selected per packet for logging. Protocol flow analysis determines the direction of flow of network traffic. Based on the direction of flow and the protocol, portions of packets can be eliminated from rule inspection.

US Patent:

20110185418, Jul 28, 2011

Filed:

Mar 8, 2010

Appl. No.:

12/719621

Inventors:

Aaron Boteler - Perry Hall MD, US
Marc Norton - Eldersburg MD, US

Assignee:

BAE Systems Information and Electronic Systems Integration Inc. - Nashua NH

International Classification:

G06F 21/00
G06F 11/00

US Classification:

726 22

Abstract:

A digital filter correlation engine, wherein the correlation engine combines N arbitrary digital filter states based on the weights and along with a threshold generate a network incident. This network incident in turn can be feedback to another digital filter. This multi-layering capability allows the creation of higher level event detections that are time-based for a cyber security analyst to analyze, thereby reducing the amount of manual work the analyst has to do in inspecting behaviors within the network.