| 摘要 |
Figure 1, the intrusion prevention system (105) includes a traffic sorter (130), an activity monitor (140), an inter-port fusion module (160), and an outcome director (165). The activity monitor (140) includes a cross-port module (142), a port Y intrusion prevention module (144), a port X intrusion prevention module (146) and an SMTP intrusion protection module (148). Data traffic arrives from the internet (120) and leaves the computer network. The external router (110) routes data traffic to and from the computer network and the Internet (120). A firewall (170), also coupled to the intrusion prevention system (105), provides a barrier between data traffic and end users of a network, or subnet. The firewall (170) is also coupled to an internal network (180). The interport fusion module (160) combines assessment results across the port monitors (142), (144), (146), and (148) when more than one port monitor is used at any given time to track session behavior (individual activity). The output from the outcome director (165) may be routed to either the tracking module (175), where the user's activities are tracked and the tracking module (175) has a tracking database (185), or to the firewall (170), where the instruction to block access is acted on.
|
