Patent ID: 7493659
Filing Date: 2009-02-17
Classification: H04L

Abstract:
1. An intrusion detection and analysis system comprising: a data monitoring device comprising a capture engine operable to capture data passing through the network in response to a trigger and configured to monitor network traffic, decode protocols for grouping packets into different protocol presentations and assembling the packets into high level protocol groups, and analyze received data for managing the network by collecting statistics, and detecting broken lines, traffic loads, and network errors; an intrusion detection device separate from the data monitoring device, the intrusion detection device comprising a detection engine operable to perform intrusion detection on data provided by the data monitoring device; application program interfaces configured to allow the intrusion detection device access to applications of the data monitoring device to perform intrusion detection; and memory for storing reference network information used by the intrusion detection device to determine if an intrusion has occurred; wherein the application program interfaces allow the intrusion detection device to leverage the separate data monitoring device, by allowing the intrusion detection device to call an application program interface configured to open a protocol decoding application associated with the separate data monitoring device, and by allowing the intrusion detection device to call an application program interface configured to open an alarm generation application associated with the separate data monitoring device.