Protocol parsing specifications

Protocol specifications (Trellix IPS's protocol parsing mechanisms) parse through network flows to validate traffic and divide it into protocol fields which may then be actively tested against Trellix IPS-supplied attacks or Custom Attacks. By dividing protocol traffic into the appropriate fields, a Sensor can perform matches against the most specific field or subfield pertinent to an effective attack, thus resulting in very low false-positive rates. Since the parsing process is fully stateful, it allows detection of anomalies in the protocol's behavior. Additionally, this parsing makes it possible to provide an additional benefit to Trellix IPS Custom Attack writers in the form of qualifiers. Qualifiers are tests that are embodied in the name of a particular protocol field. For example, rather than specifying that an HTTP request method must be "GET", the Trellix IPS system allows you to use "http-get-req-uri" as the name of the field, saving you the requirement of providing that test in the Custom Attack, and the Sensor from having to perform an extra pattern match.