Patent ID: 9380067
Filing Date: 2016-06-28
CPC Classification: H04L

Claim Text:
1. An intrusion prevention system (IPS) detection processing method performed by a network security device deployed between an internal network device and an external network device to protect security of the internal network device, wherein the networking role of the internal network device comprises one of a server and a client wherein the external network device is a client accessing a service provided by the internal network device when the networking role played by the internal network device is the server, wherein the external network device is a server providing the service accessed by the internal network device when the networking role played by the internal network device is the client, and wherein the method comprises: performing statistical processing on traffic information that flows through the network security device; obtaining traffic characteristic information from the statistical processing on the traffic information that flows through the network security device, wherein the traffic characteristic information comprises traffic P1 flowing from an internal network to an external network and traffic P2 flowing from the external network to the internal network; determining whether the networking role of the internal network device is the client or the server by comparing a size of the traffic P1 and a size of the traffic P2; constructing, from a full IPS signature rule base of the network security device, a simplified IPS signature rule base according to the networking role of the internal network device, wherein the full IPS signature rule base includes signature rules pertaining to the networking role of the internal network device and signature rules not pertaining to the networking role of the internal network device, and wherein the simplified IPS signature rule base contains only the signature rules pertaining to the networking role of the internal network device; generating a state machine according to signature rules in the simplified IPS signature rule base; and performing IPS detection by applying the state machine to traffic flowing through the network security device, wherein the traffic comprises traffic sent from the internal network device to the external network device and traffic sent from the external network device to the internal network device.