Patent ID: 7725938
Filing Date: 2010-05-25
Classification: H04L

Abstract:
1. A method for inline intrusion detection, comprising: receiving a packet at a network gateway; storing the packet at the network gateway and assigning an identifier to the packet; transmitting a copy of the packet and the identifier from the network gateway to an intrusion detection system; analyzing the copy of the packet, by the intrusion detection system, to determine whether the packet includes an attack signature; maintaining the packet at the network gateway while the copy is analyzed by the intrusion detection system; communicating a reply message, including the identifier, from the intrusion detection system to the network gateway, the reply message indicative of the results of the analysis and the size of the reply message being less than the size of the packet; and in response to the reply message taking, by the network gateway, an action selected from the group consisting of dropping the packet, allowing the packet to pass from the network gateway to a protected network, allowing the packet to pass from the network gateway to a protected network after modifying the packet, dropping the packet and dropping any related packet, and allowing the packet and any related packet to pass from the network gateway to a protected network.