Patent ID: 8677473
Filing Date: 2014-03-18
Classification: H04L

Abstract:
1. A method for intrusion protection, comprising a computing element in a network performing the steps of: receiving a packet of a flow, the flow comprising a plurality of packets, wherein the plurality of packets represents data in the network; determining a network intrusion analysis cost-benefit value of said received packet, wherein the network intrusion analysis cost-benefit value represents a benefit for analyzing said received packet for intrusions in relation to a cost for analyzing said received packet for intrusions; comparing said network intrusion analysis cost-benefit value to a network intrusion analysis cost-benefit threshold to determine whether analyzing said received packet for intrusions before forwarding said received packet is warranted; and responsive to a determination that said analyzing said received packet for intrusions before forwarding said received packet is not warranted, forwarding said received packet, indicating that subsequent packets of the flow should be forwarded, storing said received packet, and determining whether said received packet indicates an intrusion after forwarding said received packet; wherein said received packet comprises a destination address and wherein forwarding said received packet comprises forwarding said received packet to the destination address.