Switching device, method, and computer program for efficient intrusion detection

摘要

A switching device, method, and computer program utilizes a copy technique to detect unauthorized access to a communications network. An interface of the switching device is connected to receive an original packet and copy the original packet to create a copied packet. A processor within the switching device is operable to analyze information related to the original packet or the copied packet to detect an anomaly related to the original packet or the copied packet. The processor is further operable to cause the copied packet to be forwarded to an intrusion detection system within the communications network upon detecting the anomaly.