Patent ID: 7454499
Filing Date: 2008-11-18
Classification: H04L

Abstract:
1. A method for network protection, comprising: collecting data concerning a nature of all packets across multiple different sessions which are received in a data flow; performing a statistical analysis on the collected data against an algorithmic filter to determine whether a suspicion of a multi-session attack exists; blocking packets associated with the suspected multi-session attack from remaining in the data flow; performing a deep packet inspection of all remaining packets passing in the data flow to identify good packets, bad packets and suspicious packets, wherein each of the packets includes a header portion and a payload portion, and the deep packet inspection compares non-header character strings and/or expression values within the payload portion of the packet against certain strings and/or expressions defining payload content-based threat criteria; allowing the good packets to pass on to a protected network; blocking the bad packets from entry into the protected network; and extracting the suspicious packets from the data flow for further investigation.