Protocol parsing specifications

Protocol specifications (Trellix IPS's protocol parsing mechanisms) parse through network flows to validate traffic and divide it into protocol fields, which might then be actively tested against Trellix IPS-supplied attack definitions or Custom Attack Definitions. By dividing protocol traffic into the appropriate fields, Trellix IPS can perform matches against the most specific field or sub-field pertinent to an effective attack, thus supporting signatures with very low false-positive rates. Since the parsing process is fully stateful, it allows detection of anomalies in the protocol's behavior. Additionally, this parsing makes it possible to provide an additional benefit to signature writers in the form of qualifiers. Qualifiers are tests that are embodied in the name of a particular protocol field. For example, rather than specifying that an HTTP request method must be GET, the Trellix IPS system allows the use of http-get-req-uri as the name of the field, saving the requirement of providing that test in the signature, and the Sensor from having to perform an extra pattern match.