Proactive containment of network security attacks

摘要

One embodiment disclosed relates to a method of proactive containment of network security attacks. Filtering parameters corresponding to a specific system vulnerability are determined. These parameters are distributed to network infrastructure components, and the network infrastructure components examine packets using these parameters to detect occurrence of an attack. Once an attack is detected, the network infrastructure components take action to inhibit the attack. Other embodiments are also disclosed.

主权项

1. A method of proactive containment of network security attacks, the method comprising:
identifying a specific system vulnerability; analyzing the specific system vulnerability to determine a network behavior that exploits the specific system vulnerability; determining, based upon the analysis, filtering parameters to be applied by packet filters at network infrastructure components; and distributing said filtering parameters to the network infrastructure components, wherein the network infrastructure components are to examine received packets using said filtering parameters to identify whether the packets include a predetermined sequence of packets that signal an occurrence of an attack against the specific system vulnerability, and wherein identifying the specific system vulnerability, analyzing the specific system vulnerability, determining the filtering parameters, and distributing the filtering parameters is performed prior to the identification by the network infrastructure components of a specific virus exploiting said vulnerability.