ACTIVE NETWORK DEFENSE SYSTEM AND METHOD

摘要

PROBLEM TO BE SOLVED: To provide an active network defense system which monitors and blocks traffic automatically. SOLUTION: The system is set up in an in-line state with respect to a packet traffic data flow as a part of a network infrastructure. In the configuration, all passing packets are inspected and processed. An algorithmic filter operation applies statistical threshold filtering to the data flow in order to identify a threat existing across many sessions. A trigger filtering operation applies header and content match filtering to the data flow in order to identify a threat existing within each session. Threatening packet traffic is blocked and threatening session is terminated. Suspicious traffic is extracted from the data flow and receives more comprehensive content matching examination and asset risk analyzing examination further. COPYRIGHT: (C)2011,JPO&INPIT